GitHub Advisoryadvisory · Packagist
GHSA-qm4x-ch5w-gr62 XXE in SabreDAV
HIGH
Official page ↗
- Aliases
- CVE-2014-2055
- Ecosystem
- Packagist
- Packages
- sabre/dav
- Severity
- High
- Reviewed
- 2023-07-07
Affected packages
• Packagist sabre/dav: >= 1.6.0, < 1.7.11 → fixed in 1.7.11
• Packagist sabre/dav: >= 1.8.0, < 1.8.9 → fixed in 1.8.9
Description
SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
Related
Alias · CVE (1)
- CVE-2014-2055 SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files,… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-2055 advisory
- https://github.com/sabre-io/dav/issues/414 web
- https://github.com/sabre-io/dav/commit/e3f46e0ecf83cf1d2ebf54908cde7b5ec170aa2c web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/sabre/dav/CVE-2014-2055.yaml web
- https://github.com/fruux/sabre-dav/releases/tag/1.7.11 web