CVE-2011-1921: Medium severity Apache subversion vulnerability
An unintended file contents disclosure flaw was found in the way moddavsvn module of the subversion concurrent version control system processed certain URLs, when path-access control for files and directories was enabled. A remote attacker could use this flaw to obtain information, which should be otherwise prohibited by the authorization subsystem.
Acknowledgements:
Red Hat would like to thank the Apache Subversion project for reporting this issue. Upstream acknowledges Kamesh Jayachandran of CollabNet, Inc. as the original reporter.
Other sources
The moddavsvn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz shortcircuit option is disabled, does not properly enforce permissions for files that had been publicly readable in the past, which allows remote attackers to obtain sensitive information via a replay REPORT operation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1921?
CVE-2011-1921 is considered a medium severity vulnerability due to its potential for file contents disclosure.
How do I fix CVE-2011-1921?
To fix CVE-2011-1921, you should upgrade to a patched version of Apache Subversion that addresses this flaw.
Which versions of Subversion are affected by CVE-2011-1921?
CVE-2011-1921 impacts multiple versions of Apache Subversion including 1.5.0 through 1.6.16.
What type of vulnerability is CVE-2011-1921?
CVE-2011-1921 is a file contents disclosure vulnerability within the mod_dav_svn module of Subversion.
Can CVE-2011-1921 be exploited remotely?
Yes, CVE-2011-1921 can be exploited remotely by an attacker with knowledge of the affected system's URLs.