CVE-2011-4107

Name: CVE-2011-4107
Creator: NVD / NIST
Published: 2011-11-17T19:55:01.517+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.5/10EPSS 12.85%

Last modified Jun 16, 2026

CVE-2011-4107 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.. EPSS estimates a 12.85% chance of exploitation in the next 30 days.

Description

The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

Metrics

CVSS 3.1

6.5/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Probability

12.85%

95.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-611

Affected Software

Vendor	Product	Versions
Phpmyadmin	Phpmyadmin	>= 3.3.0.0, < 3.3.10.5
Phpmyadmin	Phpmyadmin	>= 3.4.0.0, < 3.4.7.1
Fedoraproject	Fedora	14
Fedoraproject	Fedora	15
Fedoraproject	Fedora	16
Debian	Debian Linux	5.0

References

http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.htmlMailing List, Third Party Advisory
http://osvdb.org/76798Broken Link
http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txtBroken Link, Exploit
http://seclists.org/fulldisclosure/2011/Nov/21Exploit, Mailing List, Third Party Advisory
http://secunia.com/advisories/46447Broken Link, Vendor Advisory
http://securityreason.com/securityalert/8533Broken Link
http://www.debian.org/security/2012/dsa-2391Mailing List
http://www.mandriva.com/security/advisories?name=MDVSA-2011:198Broken Link
http://www.openwall.com/lists/oss-security/2011/11/03/3Mailing List
http://www.openwall.com/lists/oss-security/2011/11/03/5Mailing List
http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.phpPatch, Vendor Advisory
http://www.securityfocus.com/bid/50497Broken Link, Third Party Advisory, VDB Entry
http://www.wooyun.org/bugs/wooyun-2010-03185Broken Link, Exploit
https://bugzilla.redhat.com/show_bug.cgi?id=751112Exploit, Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/71108Third Party Advisory, VDB Entry
http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.htmlMailing List, Third Party Advisory
http://osvdb.org/76798Broken Link
http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txtBroken Link, Exploit
http://seclists.org/fulldisclosure/2011/Nov/21Exploit, Mailing List, Third Party Advisory
http://secunia.com/advisories/46447Broken Link, Vendor Advisory
http://securityreason.com/securityalert/8533Broken Link
http://www.debian.org/security/2012/dsa-2391Mailing List
http://www.mandriva.com/security/advisories?name=MDVSA-2011:198Broken Link
http://www.openwall.com/lists/oss-security/2011/11/03/3Mailing List
http://www.openwall.com/lists/oss-security/2011/11/03/5Mailing List
http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.phpPatch, Vendor Advisory
http://www.securityfocus.com/bid/50497Broken Link, Third Party Advisory, VDB Entry
http://www.wooyun.org/bugs/wooyun-2010-03185Broken Link, Exploit
https://bugzilla.redhat.com/show_bug.cgi?id=751112Exploit, Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/71108Third Party Advisory, VDB Entry

Timeline

Published: Nov 17, 2011
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2011-4107?

How severe is CVE-2011-4107?

CVE-2011-4107 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 12.85% probability of exploitation in the next 30 days.

How do I fix CVE-2011-4107?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2011-4107?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST