Unscored severity · published Aug 12, 2015
CVE-2015-3184
mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote…
–
CVSS
8.8%
EPSS
No
On KEV
Description
mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name.
Exploitation
Is it being used?
Exploit prediction (EPSS)8.8% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SU
Subversion · Apache
1.7.0; 1.7.1; 1.7.2; 1.7.3; 1.7.4; 1.7.5; +28 more · source: NVD
XC
Xcode · Apple
through 7.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-3184
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-3184
lists.apple.com
http://lists.apple.com/archives/security-announce/2016/Mar/msg00003.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2015-08/msg00022.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-1742.html
Vendor Advisory
http://subversion.apache.org/security/CVE-2015-3184-advisory.txt
www.debian.org
http://www.debian.org/security/2015/dsa-3331
www.securityfocus.com
http://www.securityfocus.com/bid/76274
More from Subversion
9.8
CVE-2017-9800
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command
8.8
CVE-2013-4246
libsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated users with commit access to corrupt FSFS repositories and cause a denial of service…
8.6
CVE-2015-5259
Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn://…
7.8
CVE-2024-45720
On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables (e.g., svn.exe, etc.) may lead to unexpected command line…
7.6
CVE-2015-5343
Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service…