← Voltar para CVEs

CVE-2021-28544

MEDIUM

4.3

Descricao

Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.

Detalhes CVE

Pontuacao CVSS v3.14.3

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado4/12/2022

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

apache:subversionapple:macosdebian:debian_linuxfedoraproject:fedora

Fraquezas (CWE)

CWE-200CWE-200

Referencias

http://seclists.org/fulldisclosure/2022/Jul/18(security@apache.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZ4ARNGLMGYBKYDX2B7DRBNMF6EH3A6R/(security@apache.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJPMCWCGWBN3QWCDVILWQWPC75RR67LT/(security@apache.org)

https://subversion.apache.org/security/CVE-2021-28544-advisory.txt(security@apache.org)

https://support.apple.com/kb/HT213345(security@apache.org)

https://www.debian.org/security/2022/dsa-5119(security@apache.org)

http://seclists.org/fulldisclosure/2022/Jul/18(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZ4ARNGLMGYBKYDX2B7DRBNMF6EH3A6R/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJPMCWCGWBN3QWCDVILWQWPC75RR67LT/(af854a3a-2127-422b-91ae-364da2661108)

https://subversion.apache.org/security/CVE-2021-28544-advisory.txt(af854a3a-2127-422b-91ae-364da2661108)

https://support.apple.com/kb/HT213345(af854a3a-2127-422b-91ae-364da2661108)

https://www.debian.org/security/2022/dsa-5119(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.