PT-2024-32272 · Apache+7 · Apache Subversion+7

Haozi · Published 2024-09-13 · Updated 2025-10-16 · CVE-2024-46901

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Apache Subversion versions prior to 1.14.5

Description Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod dav svn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository.

Recommendations For versions prior to 1.14.5, upgrade to version 1.14.5, which fixes this issue. As a temporary workaround, consider restricting access to the mod dav svn module until a patch is available. Avoid using mod dav svn to serve repositories until the issue is resolved.

Fix

DoS

RCE

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-20

CWE-116

Related Identifiers

ALT-PU-2024-17031

ALT-PU-2024-17033

ALT-PU-2024-17143

ALT-PU-2024-17145

AZL-54056

AZL-54063

BDU:2025-03298

BIT-SUBVERSION-2024-46901

CVE-2024-46901

DLA-4127-1

MGASA-2025-0058

OESA-2024-2538

OPENSUSE-SU-2024:14570-1

OPENSUSE-SU-2024_4366-1

SUSE-SU-2024:4366-1

SUSE-SU-2024_4366-1

SUSE-SU-2025:0871-1

SUSE-SU-2025_0871-1

USN-7818-1

USN-7818-2

Affected Products

Alt Linux

Apache Subversion

Astra Linux

Debian

Linuxmint

Red Os

Suse

Ubuntu

References · 52

• https://osv.dev/vulnerability/BELL-CVE-2024-46901 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:4366-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0058 · Vendor Advisory
• https://subversion.apache.org/security/CVE-2024-46901-advisory.txt · Vendor Advisory
• https://osv.dev/vulnerability/USN-7818-2 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-54063 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-46901 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-46901 · Security Note
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0811SE18 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14570-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2538 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4127-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:0871-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-46901 · Security Note