PT-2021-7353 · Apache+6 · Apache Subversion+6

Evgeny Kotkov · Published 2021-04-12 · Updated 2024-12-23 · CVE-2021-28544

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Subversion versions prior to the fixed version

Description The issue is related to improper authorization in the centralized version control system Apache Subversion. Exploitation of this issue allows a remote attacker to access confidential data. Specifically, Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original, revealing the fact that the node was copied. Only the 'copyfrom' path is revealed, not its contents. Both httpd and svnserve servers are vulnerable.

Recommendations As a temporary workaround, consider restricting access to the copyfrom path to minimize the risk of exploitation. For versions prior to the fixed version, update to the latest version to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Incorrect Authorization

Weakness Enumeration

CWE-200

CWE-863

Related Identifiers

ALT-PU-2022-1700

ALT-PU-2023-7024

ALT-PU-2024-11076

ALT-PU-2024-17145

AZL-9367

BDU:2022-05773

BIT-SUBVERSION-2021-28544

CVE-2021-28544

DSA-5119-1

MGASA-2022-0140

OESA-2022-1647

OPENSUSE-SU-2022_1162-1

OPENSUSE-SU-2024:12007-1

ROSA-SA-2023-2216

SUSE-SU-2022:1161-1

SUSE-SU-2022:1162-1

SUSE-SU-2022:1483-1

SUSE-SU-2022_1161-1

SUSE-SU-2022_1162-1

SUSE-SU-2022_1483-1

USN-5372-1

USN-5450-1

Affected Products

Alt Linux

Apache Subversion

Astra Linux

Linuxmint

Apple Macos

Suse

Ubuntu

References · 61

• 🔥 https://subversion.apache.org/security/CVE-2021-28544-advisory.txt · Exploit
• https://osv.dev/vulnerability/DSA-5119-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-0819SE17 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0140.html · Security Note
• https://ubuntu.com/security/CVE-2021-28544 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2021-28544 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5450-1 · Vendor Advisory
• https://debian.org/security/2022/dsa-5119 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZ4ARNGLMGYBKYDX2B7DRBNMF6EH3A6R · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28544 · Security Note
• https://ubuntu.com/security/CVE-2022-24070 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJPMCWCGWBN3QWCDVILWQWPC75RR67LT · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-28544 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-28544 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:1483-1 · Vendor Advisory