CVE-2024-45720CWE-78

Apache Subversion: Command line argument injection on Windows platforms

High · published October 9, 2024

CVSS v3.1
8.2
EPSS
1%
Percentile
48.6
In the wild
Unconfirmed
What it is

On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables (e.g., svn.exe, etc.) may lead to unexpected command line argument interpretation, including argument injection and execution of other programs, if a specially crafted command line argument string is processed.

All versions of Subversion up to and including Subversion 1.14.3 are affected on Windows platforms only. Users are recommended to upgrade to version Subversion 1.14.4, which fixes this issue.

Subversion is not affected on UNIX-like platforms.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00611 · 48.6th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2024-10-09T12:38Z
EPSS history
Timeline
  • 09 OCT 12:38Z
    Apache Subversion: Command line argument injection on Windows platforms
    cvelistv5