Unscored severity · published Aug 19, 2014
CVE-2014-3528
Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier…
–
CVSS
7.4%
EPSS
No
On KEV
Description
Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.
Exploitation
Is it being used?
Exploit prediction (EPSS)7.4% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux Desktop · Redhat
6.0; 7.0 · source: NVD
EL
Enterprise Linux Hpc Node · Redhat
6.0; 7.0 · source: NVD
EL
Enterprise Linux Server · Redhat
6.0; 7.0 · source: NVD
EL
Enterprise Linux Server Eus · Redhat
6.6.z · source: NVD
EL
Enterprise Linux Workstation · Redhat
6.0; 7.0 · source: NVD
OP
Opensuse · Opensuse
12.3; 13.1 · source: NVD
SU
Subversion · Apache
1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +34 more · source: NVD
UL
Ubuntu Linux · Canonical
12.04; 14.04 · source: NVD
XC
Xcode · Apple
6.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3528
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3528
Mailing List
http://lists.apple.com/archives/security-announce/2015/Mar/msg00003.html
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2014-08/msg00038.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0165.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0166.html
secunia.com
http://secunia.com/advisories/59432
secunia.com
http://secunia.com/advisories/59584
More from Subversion
9.8
CVE-2017-9800
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command
8.8
CVE-2013-4246
libsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated users with commit access to corrupt FSFS repositories and cause a denial of service…
8.6
CVE-2015-5259
Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn://…
7.8
CVE-2024-45720
On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables (e.g., svn.exe, etc.) may lead to unexpected command line…
7.6
CVE-2015-5343
Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service…