CVE-2011-1921
06.06.2011, 19:55
The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is disabled, does not properly enforce permissions for files that had been publicly readable in the past, which allows remote attackers to obtain sensitive information via a replay REPORT operation.Enginsight
| Vendor | Product | Version |
|---|---|---|
| apache | subversion | 1.5.0 |
| apache | subversion | 1.5.1 |
| apache | subversion | 1.5.2 |
| apache | subversion | 1.5.3 |
| apache | subversion | 1.5.4 |
| apache | subversion | 1.5.5 |
| apache | subversion | 1.5.6 |
| apache | subversion | 1.5.7 |
| apache | subversion | 1.5.8 |
| apache | subversion | 1.6.0 |
| apache | subversion | 1.6.1 |
| apache | subversion | 1.6.2 |
| apache | subversion | 1.6.3 |
| apache | subversion | 1.6.4 |
| apache | subversion | 1.6.5 |
| apache | subversion | 1.6.6 |
| apache | subversion | 1.6.7 |
| apache | subversion | 1.6.8 |
| apache | subversion | 1.6.9 |
| apache | subversion | 1.6.10 |
| apache | subversion | 1.6.11 |
| apache | subversion | 1.6.12 |
| apache | subversion | 1.6.13 |
| apache | subversion | 1.6.14 |
| apache | subversion | 1.6.15 |
| apache | subversion | 1.6.16 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
References