CVE-2017-9800

CVE-2017-9800: vulnerability in Apache Subversion

Published · Updated

Follow this CVE+ Monitor Apache Subversion+ Monitor subversion

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 19%
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.
Affected products
Apache Software Foundation · Apache Subversion
Related CVEs — Apache Subversion

In the same product, most dangerous first.

CVE-2018-11803—CVE-2018-11803EPSS 58.5%CVE-2020-17525—Remote unauthenticated denial-of-service in Subversion mod_authz_svnEPSS 40.1%CVE-2022-24070—Apache Subversion mod_dav_svn is vulnerable to memory corruptionEPSS 9.5%CVE-2016-8734—CVE-2016-8734EPSS 6.4%CVE-2021-28544—Apache Subversion SVN authz protected copyfrom paths regressionEPSS 2.8%CVE-2024-46901LOWApache Subversion: mod_dav_svn denial-of-service via control characters in pathsEPSS 1.9%