Unscored severity · published Mar 14, 2014
CVE-2013-1939
The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators…
–
CVSS
1.8%
EPSS
No
On KEV
Description
The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \ (backslash) character.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
Owncloud Server · Owncloud
4.0.0 before 4.0.14; 4.5.0 before 4.5.9; 5.0.0 before 5.0.4 · source: NVD
SA
Sabredav · Fruux
1.6.0 before 1.6.9; 1.7.0 before 1.7.7; 1.8.0 before 1.8.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1939
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1939
Vendor Advisory
http://owncloud.org/about/security/advisories/oC-SA-2013-016/
groups.google.com
https://groups.google.com/forum/?fromgroups=#%21topic/sabredav-discuss/ehOUu7wTSGQ
More from Sabredav
–
CVE-2014-2055
SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly…