CVE-2013-7140
XML External Entity (XXE) vulnerability in the CalDAV interface in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote authenticated users to read portions of arbitrary files via vectors related to the SAX builder and the WebDAV interface.
Does this matter?
Lower severity and a low EPSS score (1.78%). Track it; it rarely justifies an emergency change on its own.
Description
XML External Entity (XXE) vulnerability in the CalDAV interface in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote authenticated users to read portions of arbitrary files via vectors related to the SAX builder and the WebDAV interface. NOTE: this issue has been labeled as both absolute path traversal and XXE, but the root cause may be XXE, since XXE can be exploited to conduct absolute path traversal and other attacks.
- CVSS 2.0
- 4.0 MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
- EPSS
- 1.78% probability · 77th percentile
- CISA KEV
- Not listed
- Affected
- open-xchange/open-xchange appsuite
- Source
- cve@mitre.org
References
- http://seclists.org/bugtraq/2014/Jan/57
- http://www.osvdb.org/102194
- http://www.securityfocus.com/bid/65015
- http://www.securitytracker.com/id/1029650
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90543
- http://seclists.org/bugtraq/2014/Jan/57
- http://www.osvdb.org/102194
- http://www.securityfocus.com/bid/65015
- http://www.securitytracker.com/id/1029650
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90543
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.