CVE-2011-1991 : Multiple untrusted search path vulnerabilities in Microsoft Windows XP SP2 and S

Multiple untrusted search path vulnerabilities in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allow local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .doc, .rtf, or .txt file, related to (1) deskpan.dll in the Display Panning CPL Extension, (2) EAPHost Authenticator Service, (3) Folder Redirection, (4) HyperTerminal, (5) the Japanese Input Method Editor (IME), and (6) Microsoft Management Console (MMC), aka "Windows Components Insecure Library Loading Vulnerability."

Published 2011-09-15 12:26:49

Updated 2023-12-07 18:38:57

Source Microsoft Corporation

View at NVD, CVE.org

Products affected by CVE-2011-1991

Microsoft » Windows Xp » Update SP3
cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Windows Xp » Version: N/A Update SP2 X64 Edition
cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*
Matching versions
Microsoft » Windows 2003 Server » Update SP2
cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2003 » Update SP2
cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Windows Vista » Update SP2
cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2008 » Update SP2 X32 Edition
cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x32:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2008 » Update SP2 X64 Edition
cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2008 » Version: N/A Update SP2 Itanium Edition
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2008 » Version: R2 X64 Edition
cpe:2.3:o:microsoft:windows_server_2008:r2:*:x64:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2008 » Version: R2 Itanium Edition
cpe:2.3:o:microsoft:windows_server_2008:r2:*:itanium:*:*:*:*:*
Matching versions
Microsoft » Windows 7 » Version: N/A
cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 7 » Version: N/A Update SP1 X86 Edition
cpe:2.3:o:microsoft:windows_7:-:sp1:x86:*:*:*:*:*
Matching versions
Microsoft » Windows 7 » Version: N/A Update SP1 X64 Edition
cpe:2.3:o:microsoft:windows_7:-:sp1:x64:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2011-1991

EPSS FAQ

95.92%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2011-1991

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

References for CVE-2011-1991

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-071

Microsoft Security Bulletin MS11-071 - Important | Microsoft Docs
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12871

Repository / Oval Repository
http://www.us-cert.gov/cas/techalerts/TA11-256A.html

Microsoft Updates for Multiple Vulnerabilities | CISA
US Government Resource

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2011-1991

Products affected by CVE-2011-1991

Exploit prediction scoring system (EPSS) score for CVE-2011-1991

CVSS scores for CVE-2011-1991

References for CVE-2011-1991