Vulnerability in Apache Subversion
CVE-2014-3528
Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 4.0 (Medium). Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.074 (94.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 94th percentile — 94.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.074 · newest: 0.074 · change: 0.000
Affected products
- Apache Subversion — versions 1.0.0, 1.0.1, 1.0.2
- Apple Xcode — versions 6.1.1
- Canonical Ubuntu Linux — versions 12.04, 14.04
- openSUSE — versions 12.3, 13.1
- Red Hat Enterprise Linux Desktop — versions 6.0, 7.0
- Red Hat Enterprise Linux Hpc Node — versions 6.0, 7.0
- Red Hat Enterprise Linux Server — versions 6.0, 7.0
- Red Hat Enterprise Linux Server Eus — versions 6.6.z
- Red Hat Enterprise Linux Workstation — versions 6.0, 7.0
Weakness classification (CWE)
References
- secunia.com/advisories/59432 (third-party-advisory)
- www.ubuntu.com/usn/USN-2316-1 (vendor-advisory, Vendor Advisory)
- rhn.redhat.com/errata/RHSA-2015-0166.html (vendor-advisory, Third Party Advisory)
- support.apple.com/HT204427 (Third Party Advisory)
- www.securityfocus.com/bid/68995 (vdb-entry)
- subversion.apache.org/security/CVE-2014-3528-advisory.txt (Vendor Advisory)
- lists.apple.com/archives/security-announce/2015/Mar/msg00003.html (vendor-advisory, Mailing List, Third Party Advisory)
- rhn.redhat.com/errata/RHSA-2015-0165.html (vendor-advisory, Third Party Advisory)
- secunia.com/advisories/60722 (third-party-advisory)
- lists.opensuse.org/opensuse-updates/2014-08/msg00038.html (vendor-advisory, Third Party Advisory)