$ cve CVE-2011-1892 JSON

CVE-2011-1892 EXPLOIT

4.0

MEDIUM · CVSS 2.0 · EPSS 37.5% (pctl 98)

Patch early

A public exploit exists.

Description

Microsoft Office Groove 2007 SP2, SharePoint Workspace 2010 Gold and SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Office Groove Data Bridge Server 2007 SP2, Office Groove Management Server 2007 SP2, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, and Office Web Apps 2010 Gold and SP1 do not properly handle Web Parts containing XML classes referencing external entities, which allows remote authenticated users to read arbitrary files via a crafted XML and XSL file, aka "SharePoint Remote File Disclosure Vulnerability."

Scoring

CVSS	4.0 (MEDIUM, v2.0)
Vector	AV:N/AC:L/Au:S/C:P/I:N/A:N
EPSS	37.51% — more likely to be exploited than 98% of all CVEs
Weakness	CWE-200
On CISA KEV	no
Public exploit	yes
Published	2011-09-15
Last modified	2026-06-16

Affected (10)

Vendor	Product
microsoft	forms server
microsoft	groove
microsoft	groove data bridge server
microsoft	groove management server
microsoft	groove server
microsoft	office web apps
microsoft	sharepoint foundation
microsoft	sharepoint server
microsoft	sharepoint services
microsoft	sharepoint workspace

Public exploits

Source	Title	Date
exploit-db	SharePoint 2007/2010 and DotNetNuke < 6 - File Disclosure (via XEE)	2011-09-20

References

→ the Explorer · watch your stack · NVD