VULNERABILITY INTELLIGENCE

CVE-2013-1939

CVSS score5 MEDIUM
EPSS probability1.78%
CISA KEVNot currently listed
Published2014-03-14
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:P/I:N/A:N

Description

The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \ (backslash) character.

Weakness classification

  • CWE-20: Improper Input Validation

Primary references