Published: 06/06/2011 Updated: 19/09/2017

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x prior to 1.6.17, when the SVNPathAuthz short_circuit option is disabled, does not properly enforce permissions for files that had been publicly readable in the past, which allows remote malicious users to obtain sensitive information via a replay REPORT operation.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache subversion 1.5.0
apache subversion 1.5.3
apache subversion 1.5.6
apache subversion 1.5.5
apache subversion 1.5.4
apache subversion 1.5.1
apache subversion 1.5.8
apache subversion 1.5.7
apache subversion 1.5.2
apache subversion 1.6.15
apache subversion 1.6.3
apache subversion 1.6.2
apache subversion 1.6.11
apache subversion 1.6.10
apache subversion 1.6.14
apache subversion 1.6.1
apache subversion 1.6.0
apache subversion 1.6.9
apache subversion 1.6.13
apache subversion 1.6.16
apache subversion 1.6.5
apache subversion 1.6.4
apache subversion 1.6.7
apache subversion 1.6.6
apache subversion 1.6.8
apache subversion 1.6.12

An attacker could send crafted input to the Subversion mod_dav_svn module for Apache and cause it to crash or gain access to restricted files ...

Several vulnerabilities were discovered in Subversion, the version control system The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2011-1752 The mod_dav_svn Apache HTTPD server module can be crashed though when asked to deliver baselined WebDAV resources CVE-2011-1783 The mod_dav_svn Apache HTTP ...

CWE-264 http://www.securityfocus.com/bid/48091 http://secunia.com/advisories/44681 http://secunia.com/advisories/44633 http://www.debian.org/security/2011/dsa-2251 https://bugzilla.redhat.com/show_bug.cgi?id=709114 http://svn.apache.org/repos/asf/subversion/tags/1.6.17/CHANGES http://subversion.apache.org/security/CVE-2011-1921-advisory.txt http://www.mandriva.com/security/advisories?name=MDVSA-2011:106 http://www.securitytracker.com/id?1025619 http://www.redhat.com/support/errata/RHSA-2011-0862.html http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061913.html http://www.ubuntu.com/usn/USN-1144-1 http://secunia.com/advisories/44888 http://secunia.com/advisories/44849 http://secunia.com/advisories/45162 http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062211.html http://support.apple.com/kb/HT5130 http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html https://exchange.xforce.ibmcloud.com/vulnerabilities/67804 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18999 https://usn.ubuntu.com/1144-1/https://nvd.nist.gov

CVE-2011-1921

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect