CVE-2021-28544CWE-200

CVE-2021-28544: vulnerability in Apache Subversion

Apache Subversion SVN authz protected copyfrom paths regression

Published · Updated

Follow this CVE+ Monitor Apache Subversion+ Monitor subversion

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 2.8%
Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.
Affected products
Apache Software Foundation · Apache Subversion
Related CVEs — Apache Subversion

In the same product, most dangerous first.

CVE-2018-11803—CVE-2018-11803EPSS 58.5%CVE-2020-17525—Remote unauthenticated denial-of-service in Subversion mod_authz_svnEPSS 40.1%CVE-2017-9800—CVE-2017-9800EPSS 18.9%CVE-2022-24070—Apache Subversion mod_dav_svn is vulnerable to memory corruptionEPSS 8.9%CVE-2016-8734—CVE-2016-8734EPSS 6.4%CVE-2024-46901LOWApache Subversion: mod_dav_svn denial-of-service via control characters in pathsEPSS 1.9%