Unscored severity · published Jan 26, 2014
CVE-2013-7140
XML External Entity (XXE) vulnerability in the CalDAV interface in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote authenticated users to read portions of arbitrary…
–
CVSS
1.8%
EPSS
No
On KEV
Description
XML External Entity (XXE) vulnerability in the CalDAV interface in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote authenticated users to read portions of arbitrary files via vectors related to the SAX builder and the WebDAV interface. NOTE: this issue has been labeled as both absolute path traversal and XXE, but the root cause may be XXE, since XXE can be exploited to conduct absolute path traversal and other attacks.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OA
Open-xchange Appsuite · Open-xchange
through 7.4.1; 6.20.7; 6.22.0; 6.22.1; 7.0.1; 7.0.2; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-7140
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-7140
seclists.org
http://seclists.org/bugtraq/2014/Jan/57
www.osvdb.org
http://www.osvdb.org/102194
www.securityfocus.com
http://www.securityfocus.com/bid/65015
www.securitytracker.com
http://www.securitytracker.com/id/1029650
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/90543
More from Open-xchange Appsuite
9.9
CVE-2017-13667
OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF
9.8
CVE-2020-12645
OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory consumption
9.8
CVE-2019-7158
OX App Suite 7.10.0 and earlier has Incorrect Access Control
9.8
CVE-2017-5212
Open-Xchange GmbH OX App Suite 7.8.3 is affected by: Incorrect Access Control
9.8
CVE-2017-5210
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Information Exposure