Severity: Medium

Description: SAS XML Mapper contains an XML External Entity (XXE) vulnerability. This vulnerability also affects the XMLV2 LIBNAME engine when the AUTOMAP option is used.

Potential Impact: An attacker might perform a Denial of Service exploit or inject malicious code or data on a SAS^® server that runs compromised SAS code.

Click the Hot Fix tab in this note to access the hot fix for this issue.

Operating System and Release Information

An update for this issue is available for SAS Viya 3.4. For instructions on how to access and apply software updates, see the Updating Your SAS Viya software section in the SAS Viya 3.4 for Windows Deployment Guide at

Viya on Windows: An update for this issue is available for SAS Viya 3.4. For instructions on how to access and apply software updates, see the Updating Your SAS Viya software section in the SAS Viya 3.4 for Windows Deployment Guide at

An update for this issue is available for SAS Viya 3.4. For instructions on how to access and apply software updates, see the Updating Your SAS Viya software section in the SAS Viya 3.4 for Linux Deployment Guide at

Viya on Windows: An update for this issue is available for SAS Viya 3.5. For instructions on how to access and apply software updates, see the Updating Your SAS Viya software section in the SAS Viya 3.5 for Windows Deployment Guide at

Viya on Linux: An update for this issue is available for SAS Viya 3.5. For instructions on how to access and apply software updates, see the Updating Your SAS Viya software section in the SAS Viya 3.5 for Linux Deployment Guide at

A fix for this issue for Base SAS JAR Files 9.4_M6 is available at:

A fix for this issue for SAS XML Mapper 9.45 is available at: