CVEvulnerability
CVE-2011-4107
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2011-11-17
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-611
Description
The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
Affected configurations
• phpmyadmin phpmyadmin (>= 3.3.0.0 < 3.3.10.5)
• phpmyadmin phpmyadmin (>= 3.4.0.0 < 3.4.7.1)
• fedoraproject fedora 14
• fedoraproject fedora 15
• fedoraproject fedora 16
• debian debian linux 5.0
Related
Weakness · CWE (1)
- CWE-611 Improper Restriction of XML External Entity Reference weakness
Referenced by CWE · observed example (1)
- CWE-611 Improper Restriction of XML External Entity Reference weakness
References
- http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.html Mailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.html Mailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.html Mailing List, Third Party Advisory
- http://osvdb.org/76798 Broken Link
- http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txt Broken Link, Exploit
- http://seclists.org/fulldisclosure/2011/Nov/21 Exploit, Mailing List, Third Party Advisory
- http://secunia.com/advisories/46447 Broken Link, Vendor Advisory
- http://securityreason.com/securityalert/8533 Broken Link
- http://www.debian.org/security/2012/dsa-2391 Mailing List
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:198 Broken Link
- http://www.openwall.com/lists/oss-security/2011/11/03/3 Mailing List
- http://www.openwall.com/lists/oss-security/2011/11/03/5 Mailing List
- http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php Patch, Vendor Advisory
- http://www.securityfocus.com/bid/50497 Broken Link, Third Party Advisory, VDB Entry
- http://www.wooyun.org/bugs/wooyun-2010-03185 Broken Link, Exploit
- https://bugzilla.redhat.com/show_bug.cgi?id=751112 Exploit, Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/71108 Third Party Advisory, VDB Entry
- http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.html Mailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.html Mailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.html Mailing List, Third Party Advisory
- http://osvdb.org/76798 Broken Link
- http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txt Broken Link, Exploit
- http://seclists.org/fulldisclosure/2011/Nov/21 Exploit, Mailing List, Third Party Advisory
- http://secunia.com/advisories/46447 Broken Link, Vendor Advisory
- http://securityreason.com/securityalert/8533 Broken Link
- http://www.debian.org/security/2012/dsa-2391 Mailing List
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:198 Broken Link
- http://www.openwall.com/lists/oss-security/2011/11/03/3 Mailing List
- http://www.openwall.com/lists/oss-security/2011/11/03/5 Mailing List
- http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php Patch, Vendor Advisory
- http://www.securityfocus.com/bid/50497 Broken Link, Third Party Advisory, VDB Entry
- http://www.wooyun.org/bugs/wooyun-2010-03185 Broken Link, Exploit
- https://bugzilla.redhat.com/show_bug.cgi?id=751112 Exploit, Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/71108 Third Party Advisory, VDB Entry