Definition
New Search
XML External Entities Resolution Vulnerability
oval:org.mitre.oval:def:12664
The XML Editor in Microsoft InfoPath 2007 SP2 and 2010; SQL Server 2005 SP3 and SP4 and 2008 SP1 SP2 and R2; SQL Server Management Studio Express (SSMSE) 2005; and Visual Studio 2005 SP1 2008 SP1 and 2010 does not properly handle external entities which allows remote attackers to read arbitrary files via a crafted .disco (Web Service Discovery) file aka "XML External Entities Resolution Vulnerability."
Family:
windows
Status:
ACCEPTED
Platform(s):
- Microsoft Windows 7
- Microsoft Windows 2000
- Microsoft Windows Server 2003
- Microsoft Windows XP
- Microsoft Windows Server 2008
- Microsoft Windows Vista
Class:
vulnerability
Reference(s):
- CVE-2011-1280
Product(s):
- Microsoft SQL Server 2008 R2
- Microsoft Visual Studio 2010
- Microsoft SQL Server 2005 Express Edition
- Microsoft Visual Studio 2005
- Microsoft SQL Server Management Studio Express (SSMSE) 2005
- Microsoft SQL Server 2005
- Microsoft Visual Studio 2008
- Microsoft Office InfoPath 2010
- Microsoft SQL Server 2008
- Microsoft Office InfoPath 2007