Log in Start free

Vulnerability · Published Apr 12, 2022 · Assigned by apache

CVE-2021-28544Apache Subversion SVN authz protected copyfrom paths regression

Medium 4.3

In plain English

A medium-severity information exposure in Apache Subversion from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)4.3Medium
Exploit odds (30 days)2.8%top 13.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20subversion1.14.2-r0ALPINE-CVE-2021-28544
Alpine:v3.21subversion1.14.2-r0ALPINE-CVE-2021-28544
Alpine:v3.22subversion1.14.2-r0ALPINE-CVE-2021-28544
Alpine:v3.23subversion1.14.2-r0ALPINE-CVE-2021-28544
Alpine:v3.24subversion1.14.2-r0ALPINE-CVE-2021-28544
Debian:12subversion1.14.2-1DEBIAN-CVE-2021-28544
Debian:13subversion1.14.2-1DEBIAN-CVE-2021-28544
Debian:14subversion1.14.2-1DEBIAN-CVE-2021-28544
Ubuntu:22.04:LTSsubversion1.14.1-3ubuntu0.22.04.1UBUNTU-CVE-2021-28544
Ubuntu:22.04:LTSsubversion1.14.1-3ubuntu0.22.04.1USN-5450-1

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Subversion 1.10.0 to 1.14.1

Weakness: CWE-200

References