Unscored severity · published Dec 23, 2004
CVE-2004-0749
The mod_authz_svn module in Subversion 1.0.7 and earlier does not properly restrict access to all metadata on unreadable paths, which could allow remote attackers to gain…
–
CVSS
1.5%
EPSS
No
On KEV
Description
The mod_authz_svn module in Subversion 1.0.7 and earlier does not properly restrict access to all metadata on unreadable paths, which could allow remote attackers to gain sensitive information via (1) svn log -v, (2) svn propget, or (3) svn blame, and other commands that follow renames.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Linux · Gentoo
0.5; 0.7; 1.1a; 1.2; 1.4; 1.4; +2 more · source: NVD
SU
Subversion · Subversion
1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +5 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-0749
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-0749
fedoranews.org
http://fedoranews.org/updates/FEDORA-2004-318.shtml
Patch
http://subversion.tigris.org/security/CAN-2004-0749-advisory.txt
Patch
http://www.gentoo.org/security/en/glsa/glsa-200409-35.xml
Patch
http://www.securityfocus.com/bid/11243
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/17472
More from Linux
9.8
CVE-2024-12084
Rsync: heap buffer overflow in rsync due to improper checksum length handling
7.5
CVE-2024-12087
Rsync: path traversal vulnerability in rsync
7.5
CVE-2024-12088
Rsync: --safe-links option bypass leads to path traversal
7.5
CVE-2024-12085
Rsync: info leak via uninitialized stack contents
6.8
CVE-2024-12086
A flaw was found in rsync