  thus allowing unprivileged database users to attempt to fetch data
      with the privileges of the database server.  While the external data
      wouldn't get returned directly to the user, portions of it could be
      exposed in error messages if the data didn't parse as valid XML; and
      in any case the mere ability to check existence of a file might be
      useful to an attacker.  (CVE-2012-3489)
     </P
></LI
><LI
><P
>      Prevent access to external files/URLs via <TT
CLASS="FILENAME"
>contr