CVE-2013-4262

Published: Jul 28, 2014Modified: May 6, 2026

2.4

Vector

AV:L/AC:H/Au:S/C:N/I:P/A:P

Exploitability: 1.5 / Impact: 4.9

Source: NVD

Description

svnwcsub.py in Subversion 1.8.0 before 1.8.3, when using the --pidfile option and running in foreground mode, allows local users to gain privileges via a symlink attack on the pid file. NOTE: this issue was SPLIT due to different affected versions (ADT3). The irkerbridge.py issue is covered by CVE-2013-7393.

Affected (3)

Products: Apache: Subversion

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Apache Subversion	Version 1.8.0
Apache Subversion	Version 1.8.1
Apache Subversion	Version 1.8.2

Related CWEs

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (4)

http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html

Source: secalert@redhat.com

https://subversion.apache.org/security/CVE-2013-4262-advisory.txt

Source: secalert@redhat.com

Vendor Advisory

http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://subversion.apache.org/security/CVE-2013-4262-advisory.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.