CVE-2011-1892

CVE-2011-1892 is a remote file disclosure vulnerability affecting various Microsoft Office and SharePoint products, including Groove 2007, SharePoint Workspace 2010, and SharePoint Server 2007/2010. The flaw stems from improper handling of Web Parts containing XML classes that reference external entities. An authenticated attacker can exploit this by crafting malicious XML and XSL files to read arbitrary files from the affected system. The vulnerability has a CVSS score of 4.0, indicating a medium severity. It requires authentication (Au:S) but has a low attack complexity (AC:L) and can be exploited over the network (AV:N). The primary impact is confidentiality (C:P), allowing for information disclosure without affecting integrity or availability. While not listed in CISA's KEV catalog, an exploit for this vulnerability (EDB-17873) is available on ExploitDB, demonstrating its practical exploitability. Despite this, there is no evidence of active exploitation, Metasploit or Nuclei modules, or significant community discussion or media coverage surrounding this CVE.