Vulnerability Details : CVE-2004-0749
The mod_authz_svn module in Subversion 1.0.7 and earlier does not properly restrict access to all metadata on unreadable paths, which could allow remote attackers to gain sensitive information via (1) svn log -v, (2) svn propget, or (3) svn blame, and other commands that follow renames.
Products affected by CVE-2004-0749
- cpe:2.3:o:gentoo:linux:1.4:rc2:*:*:*:*:*:*
- cpe:2.3:o:gentoo:linux:1.4:rc1:*:*:*:*:*:*
- cpe:2.3:o:gentoo:linux:1.2:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:linux:0.5:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:linux:0.7:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:linux:1.1a:*:*:*:*:*:*:*
- cpe:2.3:o:gentoo:linux:1.4:rc3:*:*:*:*:*:*
- cpe:2.3:o:gentoo:linux:1.4:*:*:*:*:*:*:*
- cpe:2.3:a:subversion:subversion:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:subversion:subversion:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:subversion:subversion:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:subversion:subversion:1.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:subversion:subversion:1.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:subversion:subversion:1.1.0_rc3:*:*:*:*:*:*:*
- cpe:2.3:a:subversion:subversion:1.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:subversion:subversion:1.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:subversion:subversion:1.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:subversion:subversion:1.1.0_rc1:*:*:*:*:*:*:*
- cpe:2.3:a:subversion:subversion:1.1.0_rc2:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2004-0749
2.90%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 90 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2004-0749
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST |
References for CVE-2004-0749
-
http://fedoranews.org/updates/FEDORA-2004-318.shtml
FedoraNEWS.ORG
-
http://subversion.tigris.org/security/CAN-2004-0749-advisory.txt
Patch;Vendor Advisory
-
http://www.gentoo.org/security/en/glsa/glsa-200409-35.xml
Subversion: Metadata information leak (GLSA 200409-35) — Gentoo securityPatch;Vendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/17472
Subversion mod_authz_svn information disclosure CVE-2004-0749 Vulnerability Report
-
http://www.securityfocus.com/bid/11243
Patch;Vendor Advisory
Jump to