VYPR
← All advisories
Unrated severityNVD Advisory· Published Jan 26, 2014· Updated Jun 17, 2026

CVE-2013-7140

CVE-2013-7140

Description

XML External Entity (XXE) vulnerability in the CalDAV interface in Open-Xchange (OX) AppSuite 7.4.1 and earlier allows remote authenticated users to read portions of arbitrary files via vectors related to the SAX builder and the WebDAV interface. NOTE: this issue has been labeled as both absolute path traversal and XXE, but the root cause may be XXE, since XXE can be exploited to conduct absolute path traversal and other attacks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

11
  • Open-Xchange/Appsuite11 versions
    cpe:2.3:a:open-xchange:open-xchange_appsuite:*:*:*:*:*:*:*:*+ 10 more
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:*:*:*:*:*:*:*:*range: <=7.4.1
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:6.20.7:*:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:6.22.0:*:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:6.22.1:*:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:open-xchange:open-xchange_appsuite:7.4.0:*:*:*:*:*:*:*
    • (no CPE)range: <=7.4.1

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.