Home > Vulnerability Database > CVE-2011-4107

Mend.io Vulnerability Database

CVE-2011-4107

Date: November 17, 2011

The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

Language: PHP

Severity Score

6.5

Related Resources (24)

Url: http://osvdb.org/76798

Url: http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.html

Url: http://www.debian.org/security/2012/dsa-2391

Url: http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.html

Url: http://www.securityfocus.com/bid/50497

Url: http://www.wooyun.org/bugs/wooyun-2010-03185

Url: https://github.com/phpmyadmin/phpmyadmin/commit/5fa86b8e81565c15ddbc359e8f59ecd829a2b717

Url: http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txt

Url: https://github.com/phpmyadmin/phpmyadmin/commit/2fbf631384fd8cded55f4500cb87b129442f9ed2

Url: https://nvd.nist.gov/vuln/detail/CVE-2011-4107

Url: https://github.com/phpmyadmin/phpmyadmin

Url: http://seclists.org/fulldisclosure/2011/Nov/21

Url: http://www.mandriva.com/security/advisories?name=MDVSA-2011:198

Url: http://www.openwall.com/lists/oss-security/2011/11/03/3

Url: http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php

Url: https://bugzilla.redhat.com/show_bug.cgi?id=751112

Url: http://securityreason.com/securityalert/8533

Url: http://www.openwall.com/lists/oss-security/2011/11/03/5

Url: https://github.com/phpmyadmin/phpmyadmin/commit/34d99de000de9d15cfdf5e9cc8b7682d51110bbd

Url: https://github.com/phpmyadmin/phpmyadmin/commit/a5e206fbd2ca814042cfc1bb7dd3b40c28ce3fb5

Url: http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.html

Url: https://exchange.xforce.ibmcloud.com/vulnerabilities/71108

Url: http://secunia.com/advisories/46447

Url: https://www.mend.io/vulnerability-database/CVE-2011-4107

Severity Score

6.5

Weakness Type (CWE)

Improper Restriction of XML External Entity Reference ('XXE')

CWE-611

Information Leak / Disclosure

CWE-200

CVSS v3.1

Base Score:	6.5
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	NONE
Availability (A):	NONE

CVSS v2

Base Score:	4.3
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	NONE
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2011-4107

Date: November 17, 2011

Language: PHP

Severity Score

Related Resources (24)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?