CVE-2020-17525CWE-476

Remote unauthenticated denial-of-service in Subversion mod_authz_svn

published March 17, 2021

CVSS

—

EPSS

40%

Percentile

98.6

In the wild

Unconfirmed

What it is

Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL. This can lead to disruption for users of the service. This issue was fixed in mod_dav_svn+mod_authz_svn servers 1.14.1 and mod_dav_svn+mod_authz_svn servers 1.10.7

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.40075 · 98.6th percentile
Weakness: CWE-476 · NULL Pointer Dereference
Published: 2021-03-17T09:20Z

EPSS history

Timeline

17 MAR 09:20Z
Remote unauthenticated denial-of-service in Subversion mod_authz_svn
cvelistv5