CVE-2015-2556: Infoleak
The InfoPath Forms Services component in Microsoft SharePoint Server 2007 SP3 and 2010 SP2 misparses DTDs, which allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka "Microsoft SharePoint Information Disclosure Vulnerability."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2556?
CVE-2015-2556 has a severity rating of important according to Microsoft.
How do I fix CVE-2015-2556?
To remediate CVE-2015-2556, apply the security updates provided in Microsoft Security Bulletin MS15-110.
What types of attacks does CVE-2015-2556 expose users to?
CVE-2015-2556 exposes users to XML External Entity (XXE) attacks that can lead to arbitrary file reading.
Which versions of Microsoft SharePoint are affected by CVE-2015-2556?
CVE-2015-2556 affects Microsoft SharePoint Server 2007 SP3 and 2010 SP2.
Can CVE-2015-2556 be exploited remotely?
Yes, CVE-2015-2556 can be exploited remotely by attackers through specially crafted XML documents.