CVE-2021-28544
Apache Subversion SVN authz protected copyfrom paths regression
- State
- Published
- Severity
- Not scored
- Published
- Apr 12, 2022
- Updated
- Aug 3, 2024
- Reserved
- Mar 16, 2021
Description
Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.
Scores
The record has no CVSS score.
Weaknesses
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected Products
| Product | Versions |
|---|---|
Apache SubversionApache Software Foundation |
|
References
- https://subversion.apache.org/security/CVE-2021-28544-advisory.txt
- DSA-5119vendor-advisory
- FEDORA-2022-13cc09ecf2vendor-advisory
- FEDORA-2022-2af658b090vendor-advisory
- https://support.apple.com/kb/HT213345
- 20220721 APPLE-SA-2022-07-20-2 macOS Monterey 12.5mailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.