CVE-2013-1939

Name of the Vulnerable Software and Affected Versions SabreDAV versions 1.6.8 and earlier, 1.7.x prior to 1.7.7, 1.8.x prior to 1.8.5

Description The issue arises from the HTMLBrowser plugin in SabreDAV, which does not properly check path separators in the base path when running on Windows. This allows remote attackers to read arbitrary files via a `` (backslash) character.

Recommendations For SabreDAV versions 1.6.8 and earlier, update to version 1.6.9 or later. For SabreDAV versions 1.7.x prior to 1.7.7, update to version 1.7.7 or later. For SabreDAV versions 1.8.x prior to 1.8.5, update to version 1.8.5 or later.