CVE-2021-28544

EUVD-2021-15220

12.04.2022, 18:15

Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	4.3 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 61%

Affected Products (NVD)

Vendor	Product	Version
apache	subversion	1.10.0 ≤ 𝑥 ≤ 1.14.1
debian	debian_linux	10.0
debian	debian_linux	11.0
apple	macos	12.0 ≤ 𝑥 < 12.5

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

subversion

bookworm	1.14.2-4 fixed
bullseye	1.14.1-3+deb11u1 fixed
bullseye (security)	1.14.1-3+deb11u1 fixed
sid	1.14.4-2 fixed
stretch	not-affected
trixie	1.14.4-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

subversion

bionic	not-affected
focal	Fixed 1.13.0-3ubuntu0.1 released
impish	Fixed 1.14.1-3ubuntu0.1 released
jammy	Fixed 1.14.1-3ubuntu0.22.04.1 released
xenial	not-affected

Known Exploits!

Common Weakness Enumeration

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References

http://seclists.org/fulldisclosure/2022/Jul/18

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZ4ARNGLMGYBKYDX2B7DRBNMF6EH3A6R/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJPMCWCGWBN3QWCDVILWQWPC75RR67LT/

https://subversion.apache.org/security/CVE-2021-28544-advisory.txt