CVE-2010-3315: Medium severity subversion vulnerability

Published Oct 4, 2010

Updated

authz.c in the moddavsvn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x before 1.5.8 and 1.6.x before 1.6.13, when SVNPathAuthz shortcircuit is enabled, does not properly handle a named repository as a rule scope, which allows remote authenticated users to bypass intended access restrictions via svn commands.

Affected Software

21 affected components

Apache subversion=1.6.10

Apache subversion=1.6.2

Apache subversion=1.6.5

Apache subversion=1.6.3

Apache subversion=1.6.8

Apache subversion=1.6.0

Apache subversion=1.6.7

Apache subversion=1.6.12

Apache subversion=1.6.1

Apache subversion=1.6.4

Apache subversion=1.6.11

Apache subversion=1.6.6

Apache subversion=1.6.9

Apache subversion=1.5.5

Apache subversion=1.5.3

Apache subversion=1.5.7

Apache subversion=1.5.2

Apache subversion=1.5.4

Apache subversion=1.5.1

Apache subversion=1.5.6

Apache subversion=1.5.0

Remediation

Patch Available

http://subversion.apache.org/security/CVE-2010-3315-advisory.txt

Event History

Oct 4, 2010

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-3315?

CVE-2010-3315 is classified as a medium severity vulnerability.

How do I fix CVE-2010-3315?

To address CVE-2010-3315, upgrade to Subversion versions 1.5.8 or 1.6.13 and later.

Who is affected by CVE-2010-3315?

CVE-2010-3315 affects users of Apache Subversion versions 1.5.x before 1.5.8 and 1.6.x before 1.6.13.

What type of vulnerability is CVE-2010-3315?

CVE-2010-3315 is a security vulnerability that allows remote authenticated users to bypass authorization measures.

Can I safely use Apache Subversion versions 1.5.8 or 1.6.13 to avoid CVE-2010-3315?

Yes, upgrading to these versions or newer will mitigate the vulnerabilities associated with CVE-2010-3315.