{"id":"CVE-2011-2206","aliases":["EUVD-2011-2195","GHSA-r2jf-vq9h-96p6"],"status":"published","title":"XMLParser.pm in DJabberd before 0.85 allows remote authenticated users to read arbitrary files,...","description":"XMLParser.pm in DJabberd before 0.85 allows remote authenticated users to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference, a different vulnerability than CVE-2011-1757.","severity":{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01282,"percentile":0.70238,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-399"],"published":"2011-06-22T22:00:00Z","modified":"2026-06-16T23:30:55Z","products":[{"vendor":"brad_fitzpatrick","product":"djabberd"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2011/06/15/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch"]},{"url":"https://github.com/djabberd/DJabberd/commit/b41d6dc247a175fe8e092d6ec2c460826fa62992","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"https://raw.github.com/djabberd/DJabberd/master/CHANGES","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://groups.google.com/group/djabberd/msg/80a462d5c28873d7?dmode=source\u0026output=gplain","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2011/06/14/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2206"},{"url":"https://github.com/advisories/GHSA-r2jf-vq9h-96p6"}],"sources":{"cve":[{"id":"CVE-2011-2206","description":"XMLParser.pm in DJabberd before 0.85 allows remote authenticated users to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference, a different vulnerability than CVE-2011-1757.","status":"published","published":"2011-06-22T22:00:00Z","modified":"2024-09-16T22:10:13.553Z","updated_at":"2026-11-02T14:35:36.968002Z"}],"euvd":[{"id":"EUVD-2011-2195","description":"XMLParser.pm in DJabberd before 0.85 allows remote authenticated users to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference, a different vulnerability than CVE-2011-1757.","status":"published","published":"2011-06-22T22:00:00Z","modified":"2024-09-16T22:10:13Z","updated_at":"2026-11-03T00:55:05.279117Z"}],"ghsa":[{"id":"GHSA-r2jf-vq9h-96p6","title":"XMLParser.pm in DJabberd before 0.85 allows remote authenticated users to read arbitrary files,...","description":"XMLParser.pm in DJabberd before 0.85 allows remote authenticated users to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference, a different vulnerability than CVE-2011-1757.","status":"published","published":"2022-05-17T05:41:07Z","modified":"2023-01-28T05:04:45Z","updated_at":"2026-11-02T14:44:14.141532Z"}],"nvd":[{"id":"CVE-2011-2206","description":"XMLParser.pm in DJabberd before 0.85 allows remote authenticated users to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference, a different vulnerability than CVE-2011-1757.","status":"published","published":"2011-06-22T22:55:04.23Z","modified":"2026-06-16T23:30:55.507Z","cvss":[{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:02:08.47516Z"}]}}