Detections
Analytics

GLSA-200903-20 : WebSVN: Multiple vulnerabilities

medium Nessus Plugin ID 35818

Synopsis

The remote Gentoo host is missing one or more security-related patches.

Description

The remote host is affected by the vulnerability described in GLSA-200903-20 (WebSVN: Multiple vulnerabilities)

 James Bercegay of GulfTech Security reported a Cross-site scripting (XSS) vulnerability in the getParameterisedSelfUrl() function in index.php (CVE-2008-5918) and a directory traversal vulnerability in rss.php when magic_quotes_gpc is disabled (CVE-2008-5919).
 Bas van Schaik reported that listing.php does not properly enforce access restrictions when using an SVN authz file to authenticate users (CVE-2009-0240).
 Impact :

 A remote attacker can exploit these vulnerabilities to overwrite arbitrary files, to read changelogs or diffs for restricted projects and to hijack a user's session.
 Workaround :

 There is no known workaround at this time.

Solution

All WebSVN users should upgrade to the latest version:
 # emerge --sync # emerge --ask --oneshot --verbose '>=www-apps/websvn-2.1.0'

See Also

https://security.gentoo.org/glsa/200903-20

Plugin Details

Severity: Medium

ID: 35818

File Name: gentoo_GLSA-200903-20.nasl

Version: 1.14

Type: local

Published: 3/10/2009

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.0

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:gentoo:linux:websvn, cpe:/o:gentoo:linux

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Patch Publication Date: 3/9/2009

Reference Information

CVE: CVE-2008-5918, CVE-2008-5919, CVE-2009-0240

CWE: 22, 264, 79

GLSA: 200903-20