CVE-2014-2055 — XML External Entity (XXE) Injection in Sabredav

6 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.5%
top 32.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Sabre DAVFruux SabredavOwncloud Server
Timeline
PublishedJun 4
Latest updateMay 17

Description

SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages3 packages

▶NVDfruux/sabredav1.7.10+30
▶Packagistsabre/dav1.6.0 — 1.7.11+1

🔴Vulnerability Details

4
OSV
XXE in SabreDAV↗2022-05-17
▶
GHSA
XXE in SabreDAV↗2022-05-17
▶
CVEList
CVE-2014-2055: SabreDAV before 1↗2014-06-04
▶
OSV
CVE-2014-2055: SabreDAV before 1↗2014-06-04
▶

📋Vendor Advisories

1
Debian
CVE-2014-2055: php-sabredav - SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x befor...↗2014
▶
CVE-2014-2055 — XML External Entity (XXE) Injection | cvebase