CVE-2011-4107
Summary
| CVE | CVE-2011-4107 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2011-11-17 19:55:01 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack. |
Risk And Classification
Primary CVSS: v3.1 6.5 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Problem Types: CWE-611 | n/a
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| 2.0 | [email protected] | Primary | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:M/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Phpmyadmin | Phpmyadmin | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| phpMyAdmin 'simplexml_load_string()' Function Information Disclosure Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Broken Link, Third Party Advisory, VDB Entry |
| Debian -- Security Information -- DSA-2391-1 phpmyadmin | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | Mailing List |
| Full Disclosure: PhpMyAdmin Arbitrary File Reading | af854a3a-2127-422b-91ae-364da2661108 | seclists.org | Exploit, Mailing List, Third Party Advisory |
| phpMyAdmin Arbitrary File Read ≈ Packet Storm | af854a3a-2127-422b-91ae-364da2661108 | packetstormsecurity.org | Broken Link, Exploit |
| About Secunia Research | Flexera | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link, Vendor Advisory |
| Bug 751112 – CVE-2011-4107 phpMyAdmin: Arbitrary file read flaw by loading XML strings | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Exploit, Issue Tracking |
| Support / Security / Advisories / / MDVSA-2011:198 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | Broken Link |
| [SECURITY] Fedora 15 Update: phpMyAdmin-3.4.7.1-1.fc15 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | Mailing List, Third Party Advisory |
| phpMyAdmin - Security - PMASA-2011-17 | af854a3a-2127-422b-91ae-364da2661108 | www.phpmyadmin.net | Patch, Vendor Advisory |
| phpMyAdmin Arbitrary File Read - CXSecurity.com | af854a3a-2127-422b-91ae-364da2661108 | securityreason.com | Broken Link |
| oss-security - Re: CVE Request -- phpMyAdmin -- Arbitrary local file read flaw by loading XML strings / importing XML files | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | Mailing List |
| [SECURITY] Fedora 14 Update: phpMyAdmin-3.4.7.1-1.fc14 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | Mailing List, Third Party Advisory |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | Third Party Advisory, VDB Entry |
| oss-security - CVE Request -- phpMyAdmin -- Arbitrary local file read flaw by loading XML strings / importing XML files | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | Mailing List |
| [SECURITY] Fedora 16 Update: phpMyAdmin-3.4.7.1-1.fc16 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | Mailing List, Third Party Advisory |
| osvdb.org/76798 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | Broken Link |
| WooYun.org | 自由平等的漏洞报告平台 | af854a3a-2127-422b-91ae-364da2661108 | www.wooyun.org | Broken Link, Exploit |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.