Уязвимость раскрытия путей "copyfrom" в Apache Subversion из-за некорректной авторизации на основе путей
Описание
Серверы Apache Subversion, такие как httpd и svnserve, содержат уязвимость, связанную с раскрытием информации о скрытых путях 'copyfrom' в соответствии с настраиваемыми правилами авторизации на основе пути (authz). Когда узел копируется из защищённого местоположения, пользователи, имеющие доступ к копии, могут увидеть путь 'copyfrom' оригинала, что также раскрывает факт копирования узла. Выявляется только путь 'copyfrom', а не его содержимое.
Затронутые версии ПО
- Серверы на базе
httpdиsvnserve
Тип уязвимости
Раскрытие информации
Ссылки
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- ExploitPatchVendor Advisory
- Third Party Advisory
- Third Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- ExploitPatchVendor Advisory
- Third Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Одно из
Одно из
EPSS
4.3 Medium
CVSS3
3.5 Low
CVSS2
Дефекты
Связанные уязвимости
Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.
Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.
Apache Subversion SVN authz protected copyfrom paths regression Subver ...
Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.
EPSS
4.3 Medium
CVSS3
3.5 Low
CVSS2