Back
CVE-2019-7442
CRITICAL
An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault <=10.7 allows remote attackers to read arbitrary files or potentially bypass authentication via a crafted DTD in the SAML authentication system.
Published: May 8, 2019
Modified: Jun 17, 2026
CWE-611
CVSS Metrics
CVSSv3
Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products (1)
| Vendor | Product | Version |
|---|---|---|
| cyberark | enterprise_password_vault | * |
GitHub Security Advisory GHSA-r8q6-pf72-x4jp
An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk...
References (4)
- http://packetstormsecurity.com/files/152801/CyberArk-Enterprise-Password-Vault-10.7-XML-External-Entity-Injection.html
- https://www.octority.com/2019/05/07/cyberark-enterprise-password-vault-xml-external-entity-xxe-injection/ Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/152801/CyberArk-Enterprise-Password-Vault-10.7-XML-External-Entity-Injection.html
- https://www.octority.com/2019/05/07/cyberark-enterprise-password-vault-xml-external-entity-xxe-injection/ Exploit, Third Party Advisory
Risk Scores
CVSS Score
9.8 / 10
EPSS Score
40.01%
Top 1% most likely to be exploited
Threat Score
51.2 / 100
Data Sources
NVD
EPSS
GitHub