CVE-2013-3694

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-11-18 · updated 2026-06-16
Weakness: CWE-352

Description

BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for remote file-access folders, which allows remote attackers to read or create arbitrary files via IPv6 WebDAV requests, as demonstrated by a CSRF attack involving DNS rebinding.

Affected products

Blackberry Link: through 1.1.1.26; through 1.2.0.28; 1.0.1.12, 1.1.1.26, 1.1.1.41, 1.2.0.12

References

http://blog.cmpxchg8b.com/2013/11/qnx.html
http://www.blackberry.com/btsc/KB35315
http://blog.cmpxchg8b.com/2013/11/qnx.html
http://www.blackberry.com/btsc/KB35315

Get alerted when CVE-2013-3694 or the next vulnerability affects your stack