Unscored severity · published Jun 16, 2011
CVE-2011-1280
The XML Editor in Microsoft InfoPath 2007 SP2 and 2010; SQL Server 2005 SP3 and SP4 and 2008 SP1, SP2, and R2; SQL Server Management Studio Express (SSMSE) 2005; and Visual Studio…
–
CVSS
15.3%
EPSS
No
On KEV
Description
The XML Editor in Microsoft InfoPath 2007 SP2 and 2010; SQL Server 2005 SP3 and SP4 and 2008 SP1, SP2, and R2; SQL Server Management Studio Express (SSMSE) 2005; and Visual Studio 2005 SP1, 2008 SP1, and 2010 does not properly handle external entities, which allows remote attackers to read arbitrary files via a crafted .disco (Web Service Discovery) file, aka "XML External Entities Resolution Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)15.3% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OI
Office Infopath · Microsoft
2007; 2010; 2010 · source: NVD
SS
Sql Server · Microsoft
2005; 2005; 2005; 2005; 2005; 2005; +11 more · source: NVD
SS
Sql Server Management Studio Express · Microsoft
2005; 2005 · source: NVD
VS
Visual Studio · Microsoft
2005; 2008; 2010 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1280
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1280
secunia.com
http://secunia.com/advisories/44912
www.securityfocus.com
http://www.securityfocus.com/bid/48196
www.securitytracker.com
http://www.securitytracker.com/id?1025646
www.securitytracker.com
http://www.securitytracker.com/id?1025647
www.securitytracker.com
http://www.securitytracker.com/id?1025648
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-049
More from Office Infopath
–
CVE-2010-1257
Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPath 2003 SP3, 2007 SP1, and 2007 SP2; Office SharePoint Server 2007 SP1 and SP2;…