CVE-2015-2556

EPSS 39.14%
Published 14.10.2015 01:59:11
Last modified 12.04.2025 10:46:40
Source secure@microsoft.com
Teams watchlist Login
Open Login

The InfoPath Forms Services component in Microsoft SharePoint Server 2007 SP3 and 2010 SP2 misparses DTDs, which allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka "Microsoft SharePoint Information Disclosure Vulnerability."

Affected products Warnungen 0 Metrics 2 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Microsoft ≫ Sharepoint Server Version2007 Updatesp3

Microsoft ≫ Sharepoint Server Version2010 Updatesp2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	39.14%	0.972

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:P/I:N/A:N

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-110

http://www.securitytracker.com/id/1033804

Third Party Advisory

VDB Entry

https://nvd.nist.gov/vuln/detail/CVE-2015-2556

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2015-2556

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2015-2556

EUVD