PT-2019-14001 · If · If.Svnadmin

Published 2019-09-06 · Updated 2019-09-09 · CVE-2019-15128

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions iF.SVNAdmin versions prior to 1.6.3

Description The issue allows for a CSRF attack via the svnadmin/usercreate.php file, enabling the creation of a user.

Recommendations For versions prior to 1.6.3, update to version 1.6.3 or later to resolve the issue.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-15128

Affected Products

If.Svnadmin

References · 3

• 🔥 https://zeroauth.ltd/blog/2019/08/23/cve-2019-15128-if-svnadmin-through-1-6-2-allows-svnadmin-usercreate-php-csrf-to-create-a-user · Exploit
• https://osv.dev/vulnerability/CVE-2019-15128 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15128 · Security Note