The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \ (backslash) character.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in
    ownCloud, when running on Windows, does not properly check path separators in the base path, which allows
    remote attackers to read arbitrary files via a \ (backslash) character. (CVE-2013-1939)

Fixes archives/files problem This update patches the problem in the browser plugin for sabredav. This update patches the problem in the browser plugin for sabredav. This update patches the problem in the browser plugin for sabredav. This update patches the problem in the browser plugin for sabredav.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
434498	SCA: security update for sabre/dav (GHSA-qg5v-jw6f-rpfj)	Tenable Cloud Security	SCA Checks	medium
434498	SCA: security update for sabre/dav (GHSA-qg5v-jw6f-rpfj)	Tenable Self-Hosted Container Security	SCA Checks	medium
66386	Fedora 18 : php-sabredav-Sabre_DAV-1.6.5-5.fc18 (2013-7289)	Nessus	Fedora Local Security Checks	medium
66385	Fedora 17 : php-sabredav-Sabre_DAV-1.6.5-5.fc17 (2013-7285)	Nessus	Fedora Local Security Checks	medium
66379	Fedora 19 : php-sabredav-Sabre_DAV-1.6.5-5.fc19 (2013-7253)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-1939

medium

Tenable Plugins

medium

medium

medium

medium

medium