CVE-2013-1939 — Improper Input Validation in Sabredav

CWE-20 — Improper Input ValidationCWE-22 — Path Traversal8 documents6 sources
Severity
5.0MEDIUMNVD
EPSS
0.3%
top 47.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Fruux SabredavOwncloud ServerSabre DAV
Timeline
PublishedMar 14
Latest updateMay 14

Description

The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \ (backslash) character.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶NVDfruux/sabredav1.6.0 — 1.6.9+2
▶NVDowncloud/owncloud_server4.0.0 — 4.0.14+2
▶Packagistsabre/dav1.7.0 — 1.7.7+2

🔴Vulnerability Details

3
GHSA
SabreDAV Directory Traversal vulnerability↗2022-05-14
▶
OSV
SabreDAV Directory Traversal vulnerability↗2022-05-14
▶
CVEList
CVE-2013-1939: The HTML\Browser plugin in SabreDAV before 1↗2014-03-14
▶

📋Vendor Advisories

1
Debian
CVE-2013-1939: php-sabredav - The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x ...↗2013
▶

💬Community

3
Bugzilla
CVE-2013-1939 php-sabredav-Sabre_DAV: Local file exposure due improper icons / images path checking in the HTML Browser plug-in↗2013-04-12
▶
Bugzilla
CVE-2013-1939 php-sabredav-Sabre_DAV: Local file exposure due improper icons / images path checking in the HTML\Browser plug-in [fedora-all]↗2013-04-12
▶
Bugzilla
CVE-2013-1939 php-sabredav-Sabre_DAV: Local file exposure due improper icons / images path checking in the HTML\Browser plug-in [epel-6]↗2013-04-12
▶
CVE-2013-1939 — Improper Input Validation in Sabredav | cvebase