Severity: High

Description: The SAS Visual Analytics application accepts XML documents and processes external entities defined therein, within the View Report area of the application.

Potential Impact: This vulnerability might be exploited to gain unauthorized access to files on the file system or to perform a Denial of Service attack.

Click the Hot Fix tab in this note to access the hot fix for this issue.

Operating System and Release Information

An update for this issue is available for SAS Viya 3.3. For instructions on how to access and apply software updates, see the Managing Your Software section of the SAS Viya 3.3 Administration document at

A fix for this issue for SAS Visual Analytics 7.4 is available at:

A fix for this issue for SAS Visual Analytics 7.3 is available at: