PT-2009-1394 · Websvn · Websvn

James Bercegay · Published 2009-01-21 · Updated 2017-09-29 · CVE-2008-5919

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebSVN versions 2.0 and earlier

Description A directory traversal issue exists in the rss.php file of WebSVN, allowing remote attackers to overwrite arbitrary files when magic quotes gpc is disabled. This is achieved through directory traversal sequences in the rev parameter.

Recommendations For WebSVN versions 2.0 and earlier, consider disabling the rss.php file or restricting access to it until a fix is available. As a temporary workaround, enable magic quotes gpc to prevent directory traversal attacks.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-5919

Affected Products

Websvn

References · 12

• 🔥 https://exploit-db.com/exploits/6822 · Exploit
• 🔥 http://securityfocus.com/bid/31891 · Exploit
• 🔥 http://gulftech.org/?node=research&article_id=00132-10202008 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5919 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200903-20.xml · Vendor Advisory
• http://websvn.tigris.org/servlets/NewsItemView?newsItemID=2218 · Patch
• http://secunia.com/advisories/32338 · Vendor Advisory
• http://secunia.com/advisories/34191 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5919 · Note
• http://websvn.tigris.org/issues/show_bug.cgi?id=179 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46050 · Note
• http://securityreason.com/securityalert/4928 · Note