RCE in Tigris Websvn
CVE-2008-5920
The create_anchors function in utils.inc in WebSVN 1.x allows remote attackers to execute arbitrary PHP code via a crafted username that is processed by the preg_replace function with the eval switch.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.030 (85.9th percentile) — read the EPSS interpretation.
Affected products
- Tigris Websvn — versions 1.00, 1.01, 1.02
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)
- cve@mitre.org (Exploit, vdb-entry, x_refsource_BID)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_SREASON, third-party-advisory)
- cve@mitre.org (x_refsource_MISC)