« Volver al listado

CVE-2013-7140

Estado: ModificadaMedia (4)—

XML External Entity (XXE) vulnerability in the CalDAV interface in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote authenticated users to read portions of arbitrary files via vectors related to the SAX builder and the WebDAV interface. NOTE: this issue has been labeled as both absolute path traversal and XXE, but the root cause may be XXE, since XXE can be exploited to conduct absolute path traversal and other attacks.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Open-xchange — Open-xchange Appsuite

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-7140",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-01-26T20:55:05.877",
  "references": [
    {
      "url": "http://seclists.org/bugtraq/2014/Jan/57",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/102194",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/65015",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1029650",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90543",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/bugtraq/2014/Jan/57",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/102194",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/65015",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1029650",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90543",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "XML External Entity (XXE) vulnerability in the CalDAV interface in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote authenticated users to read portions of arbitrary files via vectors related to the SAX builder and the WebDAV interface.  NOTE: this issue has been labeled as both absolute path traversal and XXE, but the root cause may be XXE, since XXE can be exploited to conduct absolute path traversal and other attacks."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en entidades externas XML (XXE)  en la interfaz de CalDAV en Open-Xchange (OX) AppSuite 7.4.1 y anteriores permite a usuarios remotos autenticados leer porciones de archivos arbitrarios a través de vectores relacionados con el constructor de SAX y la interfaz de WebDAV. NOTA: este problema ha sido etiquetado como tanto como de recorrido ruta absoluta y XXE, pero la causa raiz puede ser XXE, ya XXE puede ser explotado para realizar el recorrido ruta absoluta y otros ataques."
    }
  ],
  "lastModified": "2026-06-17T00:01:28.100",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "567B4139-220A-46A7-B847-616F99A1EA66",
              "versionEndIncluding": "7.4.1"
            },
            {
              "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:6.20.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "983E5F3A-E7AD-4CCA-80D4-9C012AFCCDD4"
            },
            {
              "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:6.22.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F85EE0C-B7A0-455A-96F6-E4E6BA5D7216"
            },
            {
              "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:6.22.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D9572CB-9A46-492E-BDCC-E01849EF0EC0"
            },
            {
              "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "138461CD-9C27-40E5-B7A0-A37737B6E942"
            },
            {
              "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "108BCEFD-3098-4919-9B0C-E80F6FA1C102"
            },
            {
              "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DDBB02DF-1022-4FE5-B5E1-198DC58F8C1B"
            },
            {
              "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2BF31219-8390-4676-A9C4-D625A016C71E"
            },
            {
              "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "75B04598-67CD-420B-92C9-9A7459295E11"
            },
            {
              "criteria": "cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8DAEED7B-C295-42B4-A60B-2EAA596E3D65"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "CWE-611: Improper Restriction of XML External Entity Reference ('XXE')",
  "sourceIdentifier": "cve@mitre.org"
}