CVEvulnerability

CVE-2011-1921

4.3 MEDIUM Published 2011-06-06 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2011-06-06
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-264

Description

The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is disabled, does not properly enforce permissions for files that had been publicly readable in the past, which allows remote attackers to obtain sensitive information via a replay REPORT operation.

Affected configurations

• apache subversion 1.5.0 • apache subversion 1.5.1 • apache subversion 1.5.2 • apache subversion 1.5.3 • apache subversion 1.5.4 • apache subversion 1.5.5 • apache subversion 1.5.6 • apache subversion 1.5.7 • apache subversion 1.5.8 • apache subversion 1.6.0 • apache subversion 1.6.1 • apache subversion 1.6.2 • apache subversion 1.6.3 • apache subversion 1.6.4 • apache subversion 1.6.5 • apache subversion 1.6.6 • apache subversion 1.6.7 • apache subversion 1.6.8 • apache subversion 1.6.9 • apache subversion 1.6.10 • apache subversion 1.6.11 • apache subversion 1.6.12 • apache subversion 1.6.13 • apache subversion 1.6.14 • apache subversion 1.6.15 • apache subversion 1.6.16

Related

Weakness · not in database (1)

References