CVE-2011-2195: OS Command Injection
Published Oct 26, 2021
·Updated
A flaw was found in WebSVN 2.3.2. Without prior authentication, if the 'allowDownload' option is enabled in config.php, an attacker can invoke the dl.php script and pass a well formed 'path' argument to execute arbitrary commands against the underlying operating system.
Affected Software
1 affected component
WebSVN WebSVN=2.3.2
Event History
Oct 26, 2021
CVE Published
via MITRE·12:10 PM
Data Sourced
via MITRE·12:10 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this flaw?
The vulnerability ID of this flaw is CVE-2011-2195.
2
What is the severity of CVE-2011-2195?
CVE-2011-2195 has a severity of critical.
3
What is the affected software?
The affected software is WebSVN version 2.3.2.
4
What can an attacker do if they exploit this vulnerability?
An attacker can execute arbitrary commands against the underlying operating system.
5
Is authentication required to exploit this vulnerability?
No, authentication is not required to exploit this vulnerability.
6
How can this vulnerability be fixed?
To fix this vulnerability, disable the 'allowDownload' option in the config.php file of WebSVN or update to a version that includes a patch.