Apache · Apache Subversion · CVE-2021-28544
**Name of the Vulnerable Software and Affected Versions**
Apache Subversion versions prior to the fixed version
**Description**
The issue is related to improper authorization in the centralized version control system Apache Subversion. Exploitation of this issue allows a remote attacker to access confidential data. Specifically, Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original, revealing the fact that the node was copied. Only the 'copyfrom' path is revealed, not its contents. Both httpd and svnserve servers are vulnerable.
**Recommendations**
As a temporary workaround, consider restricting access to the `copyfrom` path to minimize the risk of exploitation.
For versions prior to the fixed version, update to the latest version to resolve the issue.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.