Detections
Analytics
Apache Subversion < 1.6.23 / 1.7.x < 1.7.10 Multiple Vulnerabilities
high Nessus Network Monitor Plugin ID 6854
Synopsis
The remote host is running a version of Apache Subversion that is vulnerable to multiple attack vectors.Description
Versions of Apache Subversion prior to 1.6.23, or 1.7.x prior to 1.7.10 are affected by the following vulnerabilities :- Remote denial-of-service vulnerabilities exist due to an error in the 'svnserve' server, as it does not properly handle aborted connection messages. (CVE-2013-1968, CVE-2013-2112)
- A command injection vulnerability exists in the 'svn-keyword-check.pl' hook script while processing filenames. (CVE-2013-2088)
Solution
Upgrade to Apache Subversion 1.7.10 or later. If 1.7.x cannot be obtained, 1.6.23 is also patched for these vulnerabilities.See Also
http://subversion.apache.org/security/CVE-2013-1968-advisory.txt
http://subversion.apache.org/security/CVE-2013-2088-advisory.txt
http://subversion.apache.org/security/CVE-2013-2112-advisory.txt
Plugin Details
Severity: High
ID: 6854
Family: Web Servers
Published: 6/4/2013
Updated: 3/6/2019
Nessus ID: 66890
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:apache:subversion
Patch Publication Date: 6/3/2013
Vulnerability Publication Date: 6/3/2013