CVE-2011-1280

Published: Jun 16, 2011Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The XML Editor in Microsoft InfoPath 2007 SP2 and 2010; SQL Server 2005 SP3 and SP4 and 2008 SP1, SP2, and R2; SQL Server Management Studio Express (SSMSE) 2005; and Visual Studio 2005 SP1, 2008 SP1, and 2010 does not properly handle external entities, which allows remote attackers to read arbitrary files via a crafted .disco (Web Service Discovery) file, aka "XML External Entities Resolution Vulnerability."

Affected (25)

Products: Microsoft: Office Infopath, Sql Server, Sql Server Management Studio Express, Visual Studio

Microsoft

4 products

Office Infopath

Sql Server

Sql Server Management Studio Express

Visual Studio

Configuration A

25 vulnerable

Vulnerable Software	Affected Versions
Microsoft Office Infopath	Version 2007 sp2
Microsoft Office Infopath	Version 2010
Microsoft Office Infopath	Version 2010
Microsoft Sql Server	Version 2005 sp3
Microsoft Sql Server	Version 2005 sp3
Microsoft Sql Server	Version 2005 sp3
Microsoft Sql Server	Version 2005 sp3
Microsoft Sql Server	Version 2005 sp3
Microsoft Sql Server	Version 2005 sp4
Microsoft Sql Server	Version 2005 sp4
Microsoft Sql Server	Version 2005 sp4
Microsoft Sql Server	Version 2005 sp4
Microsoft Sql Server	Version 2005 sp4
Microsoft Sql Server	Version 2008 r2
Microsoft Sql Server	Version 2008 r2
Microsoft Sql Server	Version 2008 sp1
Microsoft Sql Server	Version 2008 sp1
Microsoft Sql Server	Version 2008 sp2
Microsoft Sql Server	Version 2008 sp2
Microsoft Sql Server	Version 2008 sp2
Microsoft Sql Server Management Studio Express	Version 2005
Microsoft Sql Server Management Studio Express	Version 2005
Microsoft Visual Studio	Version 2005 sp1
Microsoft Visual Studio	Version 2008 sp1
Microsoft Visual Studio	Version 2010