--- title: "CVE-2013-7300\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2013-7300?format=md keywords: index, follow --- # CVE-2013-7300 Publication date 2 February 2014 Last updated 24 July 2024 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) Toggle side navigation ## Description Absolute path traversal vulnerability in cantata before 1.2.2 allows local users to read arbitrary files via a full pathname in a request to the internal httpd server. NOTE: this vulnerability can be leveraged by remote attackers using CVE-2013-7301. ### From the Ubuntu Security Team Automatically started HTTP server listens on all interfaces and will serve any file that the user running the HTTP server has access to, including e.g. ssh private keys. [Read the notes from the security team](https://ubuntu.com/security/CVE-2013-7300?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | cantata | 14.04 LTS trusty | Not in release | | 13.10 saucy | Ignored end of life | | 13.04 raring | Ignored end of life | | 12.10 quantal | Not in release | | 12.04 LTS precise | Not in release | | 10.04 LTS lucid | Not in release | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ## Notes --- ### [sbeattie](https://launchpad.net/~sbeattie) according to debian bug, 1.1.3 is not vulnerable to this issue ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7300) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2013-7300) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2013-7300) * [Debian](https://security-tracker.debian.org/tracker/CVE-2013-7300) ### Other references * *