CVE-2011-4107

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://osvdb.org/76798", "name": "76798", "tags": ["Broken Link"], "refsource": "OSVDB"}, {"url": "http://www.securityfocus.com/bid/50497", "name": "50497", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://seclists.org/fulldisclosure/2011/Nov/21", "name": "20111102 PhpMyAdmin Arbitrary File Reading", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "refsource": "FULLDISC"}, {"url": "http://secunia.com/advisories/46447", "name": "46447", "tags": ["Broken Link", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php", "name": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=751112", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=751112", "tags": ["Exploit", "Issue Tracking"], "refsource": "MISC"}, {"url": "http://www.wooyun.org/bugs/wooyun-2010-03185", "name": "http://www.wooyun.org/bugs/wooyun-2010-03185", "tags": ["Broken Link", "Exploit"], "refsource": "MISC"}, {"url": "http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txt", "name": "http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txt", "tags": ["Broken Link", "Exploit"], "refsource": "MISC"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.html", "name": "FEDORA-2011-15846", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "FEDORA"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.html", "name": "FEDORA-2011-15831", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "FEDORA"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.html", "name": "FEDORA-2011-15841", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "FEDORA"}, {"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:198", "name": "MDVSA-2011:198", "tags": ["Broken Link"], "refsource": "MANDRIVA"}, {"url": "http://securityreason.com/securityalert/8533", "name": "8533", "tags": ["Broken Link"], "refsource": "SREASON"}, {"url": "http://www.openwall.com/lists/oss-security/2011/11/03/3", "name": "[oss-security] 20111103 CVE Request -- phpMyAdmin -- Arbitrary local file read flaw by loading XML strings / importing XML files", "tags": ["Mailing List"], "refsource": "MLIST"}, {"url": "http://www.openwall.com/lists/oss-security/2011/11/03/5", "name": "[oss-security] 20111103 Re: CVE Request -- phpMyAdmin -- Arbitrary local file read flaw by loading XML strings / importing XML files", "tags": ["Mailing List"], "refsource": "MLIST"}, {"url": "http://www.debian.org/security/2012/dsa-2391", "name": "DSA-2391", "tags": ["Mailing List"], "refsource": "DEBIAN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71108", "name": "phpmyadmin-xml-info-disclosure(71108)", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-611"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2011-4107", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}}, "publishedDate": "2011-11-17T19:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "3.3.10.5", "versionStartIncluding": "3.3.0.0"}, {"cpe23Uri": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "3.4.7.1", "versionStartIncluding": "3.4.0.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:15:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:14:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2024-02-09T02:27Z"}