Detections
Analytics

CVS/SVN User Disclosure

medium Web App Scanning Plugin ID 98079

Language:

Synopsis

CVS/SVN User Disclosure

Description

Concurrent Version System (CVS) and Subversion (SVN) provide a method for application developers to control different versions of their code.

Occasionally, the developer's version or user information can be stored incorrectly within the code and may be visible to the end user (either in the HTML or code comments). As one of the initial steps in information gathering, cyber-criminals will spider a website and using automated methods attempt to discover any CVS/SVN information that may be present in the page.

This will aid them in developing a better understanding of the deployed application (potentially through the disclosure of version information), or it may assist in further information gathering or social engineering attacks.

Using the same automated methods, scanner was able to detect CVS or SVN details stored within the affected page.

Solution

CVS and/or SVN information should not be displayed to the end user.
This can be achieved by removing this information all together prior to deployment, or by putting this information into a server-side (PHP, ASP, JSP, etc) code comment block, as opposed to an HTML comment.

See Also

http://savannah.nongnu.org/userguide/

https://subversion.apache.org/docs/

Plugin Details

Severity: Medium

ID: 98079

Type: remote

Published: 3/31/2017

Updated: 3/10/2022

Scan Template: api, basic, full, overview, pci, scan

Risk Information

VPR

Risk Factor: Low

Score: 2.9

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: Tenable

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS Score Source: Tenable

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: Tenable

Reference Information