CVE-2011-1892

published 2011-09-15

CVE-2011-1892: Microsoft Office Groove 2007 SP2, SharePoint Workspace 2010 Gold and SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, Office SharePoint…

Priority P3 42 medium 4 CVSS 2.0

AV N AC L Au S C P I N A N

EXPLOIT

Microsoft Office Groove 2007 SP2, SharePoint Workspace 2010 Gold and SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Office Groove Data Bridge Server 2007 SP2, Office Groove Management Server 2007 SP2, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, and Office Web Apps 2010 Gold and SP1 do not properly handle Web Parts containing XML classes referencing external entities, which allows remote authenticated users to read arbitrary files via a crafted XML and XSL file, aka "SharePoint Remote File Disclosure Vulnerability."

Affected

11 ranges

Vendor	Product	Version range	Fixed in
microsoft	forms_server	—	—
microsoft	groove	—	—
microsoft	groove_data_bridge_server	—	—
microsoft	groove_management_server	—	—
microsoft	groove_server	—	—
microsoft	office_web_apps	—	—
microsoft	sharepoint_foundation	—	—
microsoft	sharepoint_server	—	—
microsoft	sharepoint_server	—	—
microsoft	sharepoint_services	—	—
microsoft	sharepoint_workspace	—	—

Detection & IOCs extracted from sources · hover to see the quote

filename xee.xsl↗

• → Look for crafted XML/XSL Web Parts containing external entity references (XXE) submitted by authenticated users to SharePoint endpoints ↗
• → Detect XXE payloads in uploaded or submitted XSL files — specifically entity expansion patterns such as `&boom;` referencing external entities ↗

• · Vulnerability requires authenticated access — unauthenticated exploitation is not possible; scope detection efforts to authenticated SharePoint sessions ↗
• · Affects multiple distinct SharePoint/Groove product lines across two generations (2007 SP2 and 2010 Gold/SP1); ensure detection coverage spans all affected products ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200