PT-2011-3477 · Apache+1 · Apache Subversion+1

Kamesh Jayachandran · Published 2011-06-06 · Updated 2024-06-15 · CVE-2011-1921

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Subversion versions 1.5.x through 1.6.16

Description The issue allows remote attackers to obtain sensitive information via a replay REPORT operation, due to improper permission enforcement for files that had been publicly readable in the past when the SVNPathAuthz short circuit option is disabled.

Recommendations For Apache Subversion versions 1.5.x through 1.6.16, update to version 1.6.17 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-1921

DSA-2251-1

OPENSUSE-SU-2024:10538-1

RHSA-2011:0862

RHSA-2011_0862

Affected Products

Apache Subversion

Red Hat

References · 70

• http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061913.html · Vendor Advisory
• http://subversion.apache.org/security/CVE-2011-1921-advisory.txt · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2011-0862.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:106 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1921 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10538-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1752 · Security Note
• http://secunia.com/advisories/44633 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-1921 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062211.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-1921 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1921 · Vendor Advisory
• http://ubuntu.com/usn/USN-1144-1 · Vendor Advisory
• http://secunia.com/advisories/44681 · Vendor Advisory