The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service (resource consumption) via a relative URL in a REPORT request.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade subversion | Aug 30, 2017 | Feb 14, 2014 |
| Debian | — | Upgrade subversion | Jul 30, 2024 | Dec 7, 2013 |
| Freebsd | — | Upgrade subversion | Dec 10, 2025 | Nov 25, 2013 |
| Oracle Solaris | — | Upgrade developer/versioning/subversion to version 1.7.5-0.175.1.17.0.2.0 on Solaris 11.1 | May 29, 2017 | Dec 7, 2013 |
| Suse | — | Upgrade subversion-develUpgrade subversion-bash-completionUpgrade subversion-rubyUpgrade subversion-perlUpgrade subversion-serverUpgrade subversion-pythonUpgrade libsvn_auth_kwallet-1-0Upgrade sle-sdk-releaseUpgrade subversion-toolsUpgrade libsvn_auth_gnome_keyring-1-0Upgrade subversion | Dec 12, 2013 | Dec 7, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub