Definition

New Search

XML External Entities Resolution Vulnerability

oval:org.mitre.oval:def:12664

The XML Editor in Microsoft InfoPath 2007 SP2 and 2010; SQL Server 2005 SP3 and SP4 and 2008 SP1 SP2 and R2; SQL Server Management Studio Express (SSMSE) 2005; and Visual Studio 2005 SP1 2008 SP1 and 2010 does not properly handle external entities which allows remote attackers to read arbitrary files via a crafted .disco (Web Service Discovery) file aka "XML External Entities Resolution Vulnerability."

Family:
windows
Status:
ACCEPTED
Platform(s):
  • Microsoft Windows 7
  • Microsoft Windows Server 2003
  • Microsoft Windows Vista
  • Microsoft Windows 2000
  • Microsoft Windows Server 2008
  • Microsoft Windows XP
Class:
vulnerability
Reference(s):
  • CVE-2011-1280
Product(s):
  • Microsoft Office InfoPath 2007
  • Microsoft SQL Server 2005 Express Edition
  • Microsoft SQL Server 2005
  • Microsoft Visual Studio 2010
  • Microsoft Visual Studio 2005
  • Microsoft SQL Server Management Studio Express (SSMSE) 2005
  • Microsoft Office InfoPath 2010
  • Microsoft SQL Server 2008
  • Microsoft SQL Server 2008 R2
  • Microsoft Visual Studio 2008