CVE-2024-46901CWE-116CWE-20

Apache Subversion: mod_dav_svn denial-of-service via control characters in paths

Low · published December 9, 2024

CVSS v3.1
3.1
EPSS
2%
Percentile
79.8
In the wild
Unconfirmed
What it is

Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository.

All versions of Subversion up to and including Subversion 1.14.4 are affected if serving repositories via mod_dav_svn. Users are recommended to upgrade to version 1.14.5, which fixes this issue.

Repositories served via other access methods are not affected.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.01930 · 79.8th percentile
Weaknesses
CWE-116 · Improper Encoding or Escaping of Output; CWE-20 · Improper Input Validation
Published
2024-12-09T09:36Z
EPSS history
Timeline
  • 09 DEC 09:36Z
    Apache Subversion: mod_dav_svn denial-of-service via control characters in paths
    cvelistv5