MEDIUM

GHSA-qg5v-jw6f-rpfj

SabreDAV Directory Traversal vulnerability

Quick fix

GHSA-qg5v-jw6f-rpfj — sabre/dav: upgrade to the fixed version with the command below.

composer require sabre/dav:^1.7.7

Details

The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a `\` (backslash) character.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/sabre/dav

Introduced in: 1.7.0Fixed in: 1.7.7

Fixcomposer require sabre/dav:^1.7.7

Packagist/sabre/dav

Introduced in: 1.8.0Fixed in: 1.8.5

Fixcomposer require sabre/dav:^1.8.5

Packagist/sabre/dav

Introduced in: 1.6.0Fixed in: 1.6.9

Fixcomposer require sabre/dav:^1.6.9

References

https://nvd.nist.gov/vuln/detail/CVE-2013-1939[ADVISORY]
https://github.com/FriendsOfPHP/security-advisories/blob/master/sabre/dav/CVE-2013-1939.yaml[WEB]
https://github.com/sabre-io/dav[PACKAGE]
https://groups.google.com/forum/?fromgroups=#!topic/sabredav-discuss/ehOUu7wTSGQ[WEB]
https://groups.google.com/forum/?fromgroups=#%21topic/sabredav-discuss/ehOUu7wTSGQ[WEB]
http://owncloud.org/about/security/advisories/oC-SA-2013-016[WEB]