PT-2024-31739 · Apache+1 · Apache Subversion+1

Orange Tsai + 1 · Published 2024-10-08 · Updated 2026-02-21 · CVE-2024-45720

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache Subversion versions up to and including 1.14.3

Description: On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables may lead to unexpected command line argument interpretation, including argument injection and execution of other programs, if a specially crafted command line argument string is processed. This issue affects Windows platforms only and does not impact UNIX-like platforms.

Recommendations: For Apache Subversion versions up to and including 1.14.3, upgrade to version 1.14.4, which fixes this issue.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

ALT-PU-2024-17031

ALT-PU-2024-17033

ALT-PU-2024-17143

ALT-PU-2024-17145

BIT-SUBVERSION-2024-45720

CVE-2024-45720

Affected Products

Alt Linux

Apache Subversion

References · 24

• https://osv.dev/vulnerability/BIT-subversion-2024-45720 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45720 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2024-45720 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45720 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2024-45720 · Vendor Advisory
• https://subversion.apache.org/security/CVE-2024-45720-advisory.txt · Vendor Advisory
• http://openwall.com/lists/oss-security/2024/10/08/3 · Note
• https://t.me/cvedetector/7463 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1844194014062653504 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1844042356426670117 · Twitter Post
• https://twitter.com/transilienceai/status/1845330856874737823 · Twitter Post
• https://twitter.com/Brandefense/status/1845864136950903301 · Twitter Post
• https://twitter.com/transilienceai/status/1845330848574218748 · Twitter Post
• https://twitter.com/oss_security/status/1843654524092985574 · Twitter Post
• https://twitter.com/CVEnew/status/1844058757178982434 · Twitter Post