{"api_version":"1","generated_at":"2026-07-23T08:25:19+00:00","cve":"CVE-2011-4107","urls":{"html":"https://cve.report/CVE-2011-4107","api":"https://cve.report/api/cve/CVE-2011-4107.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2011-4107","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2011-4107"},"summary":{"title":"CVE-2011-4107","description":"The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.","state":"PUBLISHED","assigner":"redhat","published_at":"2011-11-17 19:55:01","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-611","n/a"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/50497","name":"http://www.securityfocus.com/bid/50497","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Third Party Advisory","VDB Entry"],"title":"phpMyAdmin 'simplexml_load_string()' Function Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.debian.org/security/2012/dsa-2391","name":"http://www.debian.org/security/2012/dsa-2391","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"title":"Debian -- Security Information -- DSA-2391-1 phpmyadmin","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://seclists.org/fulldisclosure/2011/Nov/21","name":"http://seclists.org/fulldisclosure/2011/Nov/21","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mailing List","Third Party Advisory"],"title":"Full Disclosure: PhpMyAdmin Arbitrary File Reading","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txt","name":"http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Exploit"],"title":"phpMyAdmin Arbitrary File Read ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/46447","name":"http://secunia.com/advisories/46447","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Vendor Advisory"],"title":"About Secunia Research | Flexera","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=751112","name":"https://bugzilla.redhat.com/show_bug.cgi?id=751112","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Issue Tracking"],"title":"Bug 751112 – CVE-2011-4107 phpMyAdmin: Arbitrary file read flaw by loading XML strings","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2011:198","name":"http://www.mandriva.com/security/advisories?name=MDVSA-2011:198","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Support / Security / Advisories /  / MDVSA-2011:198 | Mandriva","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.html","name":"http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"[SECURITY] Fedora 15 Update: phpMyAdmin-3.4.7.1-1.fc15","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php","name":"http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"phpMyAdmin - Security -\nPMASA-2011-17","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securityreason.com/securityalert/8533","name":"http://securityreason.com/securityalert/8533","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"phpMyAdmin Arbitrary File Read - CXSecurity.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2011/11/03/5","name":"http://www.openwall.com/lists/oss-security/2011/11/03/5","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"title":"oss-security - Re: CVE Request -- phpMyAdmin -- Arbitrary local file\n read flaw by loading XML strings / importing XML files","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.html","name":"http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"[SECURITY] Fedora 14 Update: phpMyAdmin-3.4.7.1-1.fc14","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/71108","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/71108","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2011/11/03/3","name":"http://www.openwall.com/lists/oss-security/2011/11/03/3","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"title":"oss-security - CVE Request -- phpMyAdmin -- Arbitrary local file read flaw by loading\n XML strings / importing XML files","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.html","name":"http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"[SECURITY] Fedora 16 Update: phpMyAdmin-3.4.7.1-1.fc16","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/76798","name":"http://osvdb.org/76798","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.wooyun.org/bugs/wooyun-2010-03185","name":"http://www.wooyun.org/bugs/wooyun-2010-03185","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Exploit"],"title":"WooYun.org | 自由平等的漏洞报告平台","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-4107","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-4107","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2011","cve_id":"4107","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"phpmyadmin","cpe5":"phpmyadmin","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T00:01:50.500Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"phpmyadmin-xml-info-disclosure(71108)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/71108"},{"name":"46447","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/46447"},{"name":"76798","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/76798"},{"name":"FEDORA-2011-15846","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.html"},{"name":"[oss-security] 20111103 Re: CVE Request -- phpMyAdmin -- Arbitrary local file read flaw by loading XML strings / importing XML files","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2011/11/03/5"},{"name":"20111102 PhpMyAdmin Arbitrary File Reading","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2011/Nov/21"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php"},{"name":"DSA-2391","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2012/dsa-2391"},{"name":"FEDORA-2011-15831","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.html"},{"name":"50497","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/50497"},{"name":"MDVSA-2011:198","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2011:198"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=751112"},{"name":"8533","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/8533"},{"name":"[oss-security] 20111103 CVE Request -- phpMyAdmin -- Arbitrary local file read flaw by loading XML strings / importing XML files","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2011/11/03/3"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.wooyun.org/bugs/wooyun-2010-03185"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txt"},{"name":"FEDORA-2011-15841","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2011-11-02T00:00:00.000Z","descriptions":[{"lang":"en","value":"The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"phpmyadmin-xml-info-disclosure(71108)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/71108"},{"name":"46447","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/46447"},{"name":"76798","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/76798"},{"name":"FEDORA-2011-15846","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.html"},{"name":"[oss-security] 20111103 Re: CVE Request -- phpMyAdmin -- Arbitrary local file read flaw by loading XML strings / importing XML files","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2011/11/03/5"},{"name":"20111102 PhpMyAdmin Arbitrary File Reading","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2011/Nov/21"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php"},{"name":"DSA-2391","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2012/dsa-2391"},{"name":"FEDORA-2011-15831","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.html"},{"name":"50497","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/50497"},{"name":"MDVSA-2011:198","tags":["vendor-advisory","x_refsource_MANDRIVA"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2011:198"},{"tags":["x_refsource_MISC"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=751112"},{"name":"8533","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/8533"},{"name":"[oss-security] 20111103 CVE Request -- phpMyAdmin -- Arbitrary local file read flaw by loading XML strings / importing XML files","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2011/11/03/3"},{"tags":["x_refsource_MISC"],"url":"http://www.wooyun.org/bugs/wooyun-2010-03185"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txt"},{"name":"FEDORA-2011-15841","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.html"}]}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2011-4107","datePublished":"2011-11-17T19:00:00.000Z","dateReserved":"2011-10-18T00:00:00.000Z","dateUpdated":"2024-08-07T00:01:50.500Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2011-11-17 19:55:01","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-611","n/a"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*","versionStartIncluding":"3.3.0.0","versionEndExcluding":"3.3.10.5","matchCriteriaId":"07CC6931-2524-492E-9290-2388CD6435F9"},{"vulnerable":true,"criteria":"cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*","versionStartIncluding":"3.4.0.0","versionEndExcluding":"3.4.7.1","matchCriteriaId":"A872DC22-5EB5-4348-BEAD-61A59394AA51"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:14:*:*:*:*:*:*:*","matchCriteriaId":"BDE52846-24EC-4068-B788-EC7F915FFF11"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:15:*:*:*:*:*:*:*","matchCriteriaId":"9396E005-22D8-4342-9323-C7DEA379191D"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:*","matchCriteriaId":"706C6399-CAD1-46E3-87A2-8DFE2CF497ED"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*","matchCriteriaId":"8C757774-08E7-40AA-B532-6F705C8F7639"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2011","CveId":"4107","Ordinal":"1","Title":"CVE-2011-4107","CVE":"CVE-2011-4107","Year":"2011"},"notes":[{"CveYear":"2011","CveId":"4107","Ordinal":"1","NoteData":"The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.","Type":"Description","Title":"CVE-2011-4107"},{"CveYear":"2011","CveId":"4107","Ordinal":"2","NoteData":"2011-11-17","Type":"Other","Title":"Published"},{"CveYear":"2011","CveId":"4107","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}