Vulnerabilites related to fruux - sabredav
cve-2013-1939
Vulnerability from cvelistv5
Published
2014-03-14 16:00
Modified
2024-08-06 15:20
Severity ?
EPSS score ?
Summary
The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \ (backslash) character.
References
| ▼ | URL | Tags |
|---|---|---|
| https://groups.google.com/forum/?fromgroups=#%21topic/sabredav-discuss/ehOUu7wTSGQ | x_refsource_CONFIRM | |
| http://owncloud.org/about/security/advisories/oC-SA-2013-016/ | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T15:20:37.259Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://groups.google.com/forum/?fromgroups=#%21topic/sabredav-discuss/ehOUu7wTSGQ"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://owncloud.org/about/security/advisories/oC-SA-2013-016/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-04-10T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The HTML\\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \\ (backslash) character."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-03-14T15:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://groups.google.com/forum/?fromgroups=#%21topic/sabredav-discuss/ehOUu7wTSGQ"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://owncloud.org/about/security/advisories/oC-SA-2013-016/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2013-1939",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The HTML\\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \\ (backslash) character."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://groups.google.com/forum/?fromgroups=#!topic/sabredav-discuss/ehOUu7wTSGQ",
"refsource": "CONFIRM",
"url": "https://groups.google.com/forum/?fromgroups=#!topic/sabredav-discuss/ehOUu7wTSGQ"
},
{
"name": "http://owncloud.org/about/security/advisories/oC-SA-2013-016/",
"refsource": "CONFIRM",
"url": "http://owncloud.org/about/security/advisories/oC-SA-2013-016/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-1939",
"datePublished": "2014-03-14T16:00:00",
"dateReserved": "2013-02-19T00:00:00",
"dateUpdated": "2024-08-06T15:20:37.259Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-2055
Vulnerability from cvelistv5
Published
2014-06-04 14:00
Modified
2024-08-06 09:58
Severity ?
EPSS score ?
Summary
SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
References
| ▼ | URL | Tags |
|---|---|---|
| http://owncloud.org/about/security/advisories/oC-SA-2014-006/ | x_refsource_CONFIRM | |
| https://github.com/fruux/sabre-dav/releases/tag/1.7.11 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:58:16.322Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://owncloud.org/about/security/advisories/oC-SA-2014-006/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/fruux/sabre-dav/releases/tag/1.7.11"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-03-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-06-04T13:57:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://owncloud.org/about/security/advisories/oC-SA-2014-006/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/fruux/sabre-dav/releases/tag/1.7.11"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-2055",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://owncloud.org/about/security/advisories/oC-SA-2014-006/",
"refsource": "CONFIRM",
"url": "http://owncloud.org/about/security/advisories/oC-SA-2014-006/"
},
{
"name": "https://github.com/fruux/sabre-dav/releases/tag/1.7.11",
"refsource": "CONFIRM",
"url": "https://github.com/fruux/sabre-dav/releases/tag/1.7.11"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-2055",
"datePublished": "2014-06-04T14:00:00",
"dateReserved": "2014-02-19T00:00:00",
"dateUpdated": "2024-08-06T09:58:16.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2014-03-14 16:55
Modified
2024-11-21 01:50
Severity ?
Summary
The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \ (backslash) character.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fruux:sabredav:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7E6CC4D0-A201-42E5-AC5E-617179FA441E",
"versionEndExcluding": "1.6.9",
"versionStartIncluding": "1.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C11FC69F-A24F-45A0-B78E-D7831E20E8B9",
"versionEndExcluding": "1.7.7",
"versionStartIncluding": "1.7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0B9AFA14-DF70-48AE-A5F4-F75668D01C55",
"versionEndExcluding": "1.8.5",
"versionStartIncluding": "1.8.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2CF61F35-5905-4BA9-AD7E-7DB261D2F256",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*",
"matchCriteriaId": "80869418-F6A2-4D8B-BC2A-AA648BB84FF8",
"versionEndExcluding": "4.0.14",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E831542E-2D13-4C84-A94A-0EB8DADD77A1",
"versionEndExcluding": "4.5.9",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EEB4A18C-5F51-4B3A-8DD9-E11BA580F614",
"versionEndExcluding": "5.0.4",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2CF61F35-5905-4BA9-AD7E-7DB261D2F256",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The HTML\\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \\ (backslash) character."
},
{
"lang": "es",
"value": "El plugin HTML\\Browser en SabreDAV anterior a 1.6.9, 1.7.x anterior a 1.7.7 y 1.8.x anterior a 1.8.5, utilizado en ownCloud, cuando se ejecuta en Windows, no comprueba debidamente los separadores de rutas en la ruta base, lo que permite a atacantes remotos leer archivos arbitrarios a trav\u00e9s de un caracter \\ (barra invertida)."
}
],
"id": "CVE-2013-1939",
"lastModified": "2024-11-21T01:50:42.873",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-03-14T16:55:04.957",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://owncloud.org/about/security/advisories/oC-SA-2013-016/"
},
{
"source": "secalert@redhat.com",
"url": "https://groups.google.com/forum/?fromgroups=#%21topic/sabredav-discuss/ehOUu7wTSGQ"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://owncloud.org/about/security/advisories/oC-SA-2013-016/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://groups.google.com/forum/?fromgroups=#%21topic/sabredav-discuss/ehOUu7wTSGQ"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-06-04 14:55
Modified
2024-11-21 02:05
Severity ?
Summary
SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fruux:sabredav:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9B5CDBFF-98CD-4D83-86DE-6D9DCBDEE447",
"versionEndIncluding": "1.7.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "66015009-B675-48D1-832E-83DA572CE3D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CD6F6A89-0929-436C-AA9D-5C9785614A91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "718E00BD-5DE6-4C26-AD7B-EBEC1F4E487A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "7267D5CC-D22D-42C4-A6B8-5F7BCFCD5E78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "797523D4-B8D0-4245-9965-A968D8026304",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "550C2E4E-5D50-4A92-9C3D-E6FF68873876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4537A464-215B-4022-941A-04431C8BDA3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "8AF82071-7199-4A62-B0D5-999D3490B3A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "EB550531-7444-4692-B48A-36A04DFEF163",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "57434880-DCFF-404A-A2C8-B10AA129D0F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "5E4CC09F-E145-4390-9E03-CF14ACBDA0CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "36AFB445-B140-4103-8382-56D34C646E8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "64543375-1EC5-432F-97B0-D09ADE2DB7C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "71D19C4C-3A3A-4A1B-8FA1-8A522049CDFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "53CD9C93-83D6-433E-AE93-145063EC53DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2493DC42-655D-4B76-B30C-F1D19AA73645",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2DE58412-FCDB-4997-B5AC-9085E8222B0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "731DDDED-8D86-4EBF-889A-F26F40C4E95C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.7.7:*:*:*:*:*:*:*",
"matchCriteriaId": "67F9D01B-E039-4209-936A-738345F7AEFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.7.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C6E2E1FE-9449-464D-A6A4-ECF0775629DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C7A5745B-925B-48F5-B2BC-EFB46162505C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FBDA277B-087D-45F3-A380-15F648B1EAF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "69FAA313-7A78-456A-BC34-BA49E391EC18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "24F90183-E9FC-42C9-BE08-4A1683383736",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "45BBAF94-5DC7-40B0-A1DA-858D9B30FBBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E9C704ED-C955-4C4E-9A19-097A15DD1F76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.8.5:*:*:*:*:*:*:*",
"matchCriteriaId": "68A00A4D-75BD-46E5-BA5C-EEFCA18EA61F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.8.6:*:*:*:*:*:*:*",
"matchCriteriaId": "53F3EF8F-6475-4B8E-929C-5B6C2689AA29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.8.7:*:*:*:*:*:*:*",
"matchCriteriaId": "E5AA385C-6F5A-4E7F-B194-432FA1D7C5C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.8.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4BB211D7-8482-44C6-BF25-06D08F651E77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3A499C18-61F0-486C-99E5-F6DD74EE5521",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:6.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "237F18EA-1A9B-4DE6-B604-12EB651F5F0F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fruux:sabredav:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9B5CDBFF-98CD-4D83-86DE-6D9DCBDEE447",
"versionEndIncluding": "1.7.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "66015009-B675-48D1-832E-83DA572CE3D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CD6F6A89-0929-436C-AA9D-5C9785614A91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "718E00BD-5DE6-4C26-AD7B-EBEC1F4E487A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "7267D5CC-D22D-42C4-A6B8-5F7BCFCD5E78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "797523D4-B8D0-4245-9965-A968D8026304",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "550C2E4E-5D50-4A92-9C3D-E6FF68873876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4537A464-215B-4022-941A-04431C8BDA3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "8AF82071-7199-4A62-B0D5-999D3490B3A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "EB550531-7444-4692-B48A-36A04DFEF163",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "57434880-DCFF-404A-A2C8-B10AA129D0F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "5E4CC09F-E145-4390-9E03-CF14ACBDA0CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "36AFB445-B140-4103-8382-56D34C646E8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "64543375-1EC5-432F-97B0-D09ADE2DB7C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "71D19C4C-3A3A-4A1B-8FA1-8A522049CDFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "53CD9C93-83D6-433E-AE93-145063EC53DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2493DC42-655D-4B76-B30C-F1D19AA73645",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2DE58412-FCDB-4997-B5AC-9085E8222B0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "731DDDED-8D86-4EBF-889A-F26F40C4E95C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.7.7:*:*:*:*:*:*:*",
"matchCriteriaId": "67F9D01B-E039-4209-936A-738345F7AEFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.7.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C6E2E1FE-9449-464D-A6A4-ECF0775629DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C7A5745B-925B-48F5-B2BC-EFB46162505C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FBDA277B-087D-45F3-A380-15F648B1EAF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "69FAA313-7A78-456A-BC34-BA49E391EC18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "24F90183-E9FC-42C9-BE08-4A1683383736",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "45BBAF94-5DC7-40B0-A1DA-858D9B30FBBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E9C704ED-C955-4C4E-9A19-097A15DD1F76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.8.5:*:*:*:*:*:*:*",
"matchCriteriaId": "68A00A4D-75BD-46E5-BA5C-EEFCA18EA61F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.8.6:*:*:*:*:*:*:*",
"matchCriteriaId": "53F3EF8F-6475-4B8E-929C-5B6C2689AA29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.8.7:*:*:*:*:*:*:*",
"matchCriteriaId": "E5AA385C-6F5A-4E7F-B194-432FA1D7C5C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fruux:sabredav:1.8.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4BB211D7-8482-44C6-BF25-06D08F651E77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:*:a:*:*:*:*:*:*",
"matchCriteriaId": "CF8A525D-F052-449B-AFD8-DC6A956D30D9",
"versionEndIncluding": "5.0.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DF826F2B-83E1-4E64-A56C-B564028EBD6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "22A19441-2041-45DC-9F59-783C9B1FF9D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "43448288-B129-4210-9680-55836869F09F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "78639CDB-3763-4E71-B4F9-E51E5A261A16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8DBE1CE3-7A8D-4C97-8066-F59C346A0494",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "0F97DF5D-DC0E-43FB-B0D2-4AA8C2A5413D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "55475558-53CA-4764-9A70-1355D5759CFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2DC3BCEC-9685-4899-91B6-1889FAB235C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "D4055273-FBA3-46A7-9B0B-0A5A8BB2E0AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "56985A58-4F38-4192-AEC3-7953184206E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "D6510E0F-BA72-4591-8931-83974EFCDF0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "14E553AC-B7F1-4692-8BC7-C59CE39C5CD5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "3F1D79C4-2B24-4E55-8217-FDC00F22EC44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "16960810-E5B8-45EC-A54D-55941B1E728A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "1DF9CAFD-F2E5-4AD4-BB65-D04A87E8E3B5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack."
},
{
"lang": "es",
"value": "SabreDAV anterior a 1.7.11, utilizado en ownCloud Server anterior a 5.0.15 y 6.0.x anterior a 6.0.2, permite a atacantes remotos leer archivos arbitrarios, causar una denegaci\u00f3n de servicio o posiblemente tener otro impacto a trav\u00e9s de un ataque de entidad externa XML (XXE)."
}
],
"evaluatorComment": "Per: http://cwe.mitre.org/data/definitions/611.html\n\n\"CWE-611: Improper Restriction of XML External Entity Reference (\u0027XXE\u0027)\"",
"id": "CVE-2014-2055",
"lastModified": "2024-11-21T02:05:33.140",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-06-04T14:55:04.047",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://owncloud.org/about/security/advisories/oC-SA-2014-006/"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/fruux/sabre-dav/releases/tag/1.7.11"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://owncloud.org/about/security/advisories/oC-SA-2014-006/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/fruux/sabre-dav/releases/tag/1.7.11"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}