CVE-2011-1921

Published: Jun 6, 2011Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is disabled, does not properly enforce permissions for files that had been publicly readable in the past, which allows remote attackers to obtain sensitive information via a replay REPORT operation.

Affected (26)

Products: Apache: Subversion

1 product

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Apache Subversion	Version 1.5.0
Apache Subversion	Version 1.5.1
Apache Subversion	Version 1.5.2
Apache Subversion	Version 1.5.3
Apache Subversion	Version 1.5.4
Apache Subversion	Version 1.5.5
Apache Subversion	Version 1.5.6
Apache Subversion	Version 1.5.7
Apache Subversion	Version 1.5.8

Configuration B

17 vulnerable

Vulnerable Software	Affected Versions
Apache Subversion	Version 1.6.0
Apache Subversion	Version 1.6.10
Apache Subversion	Version 1.6.11
Apache Subversion	Version 1.6.12
Apache Subversion	Version 1.6.13
Apache Subversion	Version 1.6.14
Apache Subversion	Version 1.6.15
Apache Subversion	Version 1.6.16
Apache Subversion	Version 1.6.1
Apache Subversion	Version 1.6.2
Apache Subversion	Version 1.6.3
Apache Subversion	Version 1.6.4
Apache Subversion	Version 1.6.5
Apache Subversion	Version 1.6.6
Apache Subversion	Version 1.6.7
Apache Subversion	Version 1.6.8
Apache Subversion	Version 1.6.9

Related CWEs

References (40)

http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062211.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061913.html

Source: secalert@redhat.com

http://secunia.com/advisories/44633

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/44681

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/44849

Source: secalert@redhat.com

http://secunia.com/advisories/44888

Source: secalert@redhat.com

http://secunia.com/advisories/45162

Source: secalert@redhat.com

http://subversion.apache.org/security/CVE-2011-1921-advisory.txt

Source: secalert@redhat.com

Vendor Advisory

http://support.apple.com/kb/HT5130

Source: secalert@redhat.com

http://svn.apache.org/repos/asf/subversion/tags/1.6.17/CHANGES

Source: secalert@redhat.com

http://www.debian.org/security/2011/dsa-2251

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2011:106

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2011-0862.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/48091

Source: secalert@redhat.com

http://www.securitytracker.com/id?1025619

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1144-1

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=709114

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/67804

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18999

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062211.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061913.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/44633

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/44681

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/44849

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/44888

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/45162

Source: af854a3a-2127-422b-91ae-364da2661108

http://subversion.apache.org/security/CVE-2011-1921-advisory.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://support.apple.com/kb/HT5130

Source: af854a3a-2127-422b-91ae-364da2661108

http://svn.apache.org/repos/asf/subversion/tags/1.6.17/CHANGES

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2011/dsa-2251

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2011:106

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2011-0862.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/48091

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1025619

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1144-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=709114

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/67804

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18999

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.