mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade subversion | Aug 30, 2017 | Aug 12, 2015 |
| Centos_linux | — | Upgrade subversion-javahlUpgrade subversion-develUpgrade subversion-toolsUpgrade subversion-rubyUpgrade subversion-gnomeUpgrade subversion-perlUpgrade mod_dav_svnUpgrade subversionUpgrade subversion-pythonUpgrade subversion-libsUpgrade subversion-kde | Dec 1, 2016 | Aug 12, 2015 |
| Debian | — | Upgrade subversion | Jul 30, 2024 | Aug 12, 2015 |
| Freebsd | — | Upgrade subversion | Dec 10, 2025 | Aug 6, 2015 |
| Gentoo Linux | — | Upgrade net-libs/serf.Upgrade dev-vcs/subversion. | Oct 30, 2017 | Aug 12, 2015 |
| Oracle_linux | — | Upgrade mod_dav_svnUpgrade subversion-pythonUpgrade subversion-kdeUpgrade subversion-develUpgrade subversion-gnomeUpgrade subversion-javahlUpgrade subversion-rubyUpgrade subversion-toolsUpgrade subversion-perlUpgrade subversion-libsUpgrade subversion | Oct 16, 2024 | Aug 12, 2015 |
| Suse | — | Upgrade libsvn_auth_gnome_keyring-1-0Upgrade subversionUpgrade subversion-bash-completionUpgrade subversion-perlUpgrade subversion-serverUpgrade subversion-develUpgrade subversion-toolsUpgrade subversion-pythonUpgrade libsvn_auth_kwallet-1-0 | Dec 18, 2015 | Aug 12, 2015 |
| Ubuntu | — | Upgrade subversionUpgrade libsvn1Upgrade libapache2-svn | Nov 8, 2024 | Aug 12, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub