CVE-2019-7442: XEE
An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault <=10.7 allows remote attackers to read arbitrary files or potentially bypass authentication via a crafted DTD in the SAML authentication system.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2019-7442.
What is the severity of CVE-2019-7442?
The severity of CVE-2019-7442 is critical with a score of 9.8.
What is the description of CVE-2019-7442?
CVE-2019-7442 is an XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault <=10.7. It allows remote attackers to read arbitrary files or potentially bypass authentication via a crafted DTD in the SAML authentication system.
What software is affected by CVE-2019-7442?
The CyberArk Enterprise Password Vault version 10.7 and below is affected by CVE-2019-7442.
How can I fix CVE-2019-7442?
To fix CVE-2019-7442, CyberArk Enterprise Password Vault users should update to a version higher than 10.7 that includes a patch for the vulnerability.