{
  "id": "CVE-2015-2556",
  "sourceIdentifier": "secure@microsoft.com",
  "published": "2015-10-14T01:59:11.077",
  "lastModified": "2024-11-21T02:27:36.037",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The InfoPath Forms Services component in Microsoft SharePoint Server 2007 SP3 and 2010 SP2 misparses DTDs, which allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka \"Microsoft SharePoint Information Disclosure Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "El componente InfoPath Forms Services en Microsoft SharePoint Server 2007 SP3 y 2010 SP2 no analiza correctamente la gram\u00e1tica de las DTDs, lo que permite a atacantes remotos leer archivos arbitrarios a trav\u00e9s de un documento XML que contiene una declaraci\u00f3n de entidad externa en conjunci\u00f3n con una referencia de entidad, relacionado con un problema XML External Entity (XXE), tambi\u00e9n conocido como 'Microsoft SharePoint Information Disclosure Vulnerability'."
    }
  ],
  "metrics": {
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "accessComplexity": "MEDIUM",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:microsoft:sharepoint_server:2007:sp3:*:*:*:*:*:*",
              "matchCriteriaId": "6B7AEA5E-C3D7-4E6D-96F0-5F9A175631C9"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "9A57C675-05A9-4BC2-AE95-7CA5CA6B1F73"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://www.securitytracker.com/id/1033804",
      "source": "secure@microsoft.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ]
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-110",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1033804",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ]
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-110",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}