CVE-2013-1939: Input Validation
Local file exposure on Windows installations
Other sources
The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \ (backslash) character.
The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \ (backslash) character.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1939?
CVE-2013-1939 is considered to have moderate severity due to its potential to allow file exposure on Windows installations.
How do I fix CVE-2013-1939?
To fix CVE-2013-1939, upgrade SabreDAV to version 1.6.9, 1.7.7, or 1.8.5 or later.
What versions of SabreDAV are affected by CVE-2013-1939?
CVE-2013-1939 affects SabreDAV versions prior to 1.6.9, 1.7.7, and 1.8.5.
Is CVE-2013-1939 specific to any operating system?
Yes, CVE-2013-1939 is specifically related to Windows installations of SabreDAV.
What are the implications of CVE-2013-1939 for my SabreDAV installation?
The implication of CVE-2013-1939 is that an attacker could potentially exploit this vulnerability to read arbitrary files on vulnerable installations.