CVE-2011-1921 The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is disabled, does not properly enforce....
MediumCVSS 4.3
EPSS 6.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is disabled, does not properly enforce permissions for files that had been publicly readable in the past, which allows remote attackers to obtain sensitive information via a replay REPORT operation.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache subversion | = 1.5.0 | No fix listed |
| apache subversion | = 1.5.1 | No fix listed |
| apache subversion | = 1.5.2 | No fix listed |
| apache subversion | = 1.5.3 | No fix listed |
| apache subversion | = 1.5.4 | No fix listed |
| apache subversion | = 1.5.5 | No fix listed |
| apache subversion | = 1.5.6 | No fix listed |
| apache subversion | = 1.5.7 | No fix listed |
| apache subversion | = 1.5.8 | No fix listed |
| apache subversion | = 1.6.0 | No fix listed |
| apache subversion | = 1.6.1 | No fix listed |
| apache subversion | = 1.6.2 | No fix listed |
| apache subversion | = 1.6.3 | No fix listed |
| apache subversion | = 1.6.4 | No fix listed |
| apache subversion | = 1.6.5 | No fix listed |
| apache subversion | = 1.6.6 | No fix listed |
| apache subversion | = 1.6.7 | No fix listed |
| apache subversion | = 1.6.8 | No fix listed |
| apache subversion | = 1.6.9 | No fix listed |
| apache subversion | = 1.6.10 | No fix listed |
| apache subversion | = 1.6.11 | No fix listed |
| apache subversion | = 1.6.12 | No fix listed |
| apache subversion | = 1.6.13 | No fix listed |
| apache subversion | = 1.6.14 | No fix listed |
| apache subversion | = 1.6.15 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache subversion | = 1.6.16 | No fix listed |
| debian/subversion(Debian:12) | < 1.6.17dfsg-1 | 1.6.17dfsg-1 |
| debian/subversion(Debian:13) | < 1.6.17dfsg-1 | 1.6.17dfsg-1 |
| debian/subversion(Debian:14) | < 1.6.17dfsg-1 | 1.6.17dfsg-1 |
References
- APPLE-SA-2012-02-01-1 vendor-advisory
- FEDORA-2011-8341 vendor-advisory
- FEDORA-2011-8352 vendor-advisory
- 44633 third-party-advisory vendor-advisory
- 44681 third-party-advisory vendor-advisory
- 44849 third-party-advisory
- 44888 third-party-advisory
- 45162 third-party-advisory
- subversion.apache.org vendor-advisory
- support.apple.com
- svn.apache.org
- DSA-2251 vendor-advisory
- MDVSA-2011:106 vendor-advisory
- RHSA-2011:0862 vendor-advisory
- 48091 vdb-entry
- 1025619 vdb-entry
- USN-1144-1 vendor-advisory
- bugzilla.redhat.com
- subversion-control-rules-info-disc(67804) vdb-entry
- oval:org.mitre.oval:def:18999 signature vdb-entry
- Debian Security Tracker CVE-2011-1921 vendor-advisory