CVE-2007-2448
published 2007-06-14CVE-2007-2448: Subversion 1.4.3 and earlier does not properly implement the "partial access" privilege for users who have access to changed paths but not copied paths, which…
PriorityP410low2.1CVSS 2.0
AVNACHAuSCPINAN
EPSS
1.52%
72.0th percentile
Subversion 1.4.3 and earlier does not properly implement the "partial access" privilege for users who have access to changed paths but not copied paths, which allows remote authenticated users to obtain sensitive information (revision properties) via svn (1) propget, (2) proplist, or (3) propedit.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | subversion | — | — |
| apache | subversion | >= 0 < 1.4.4dfsg1-1 | 1.4.4dfsg1-1 |
| apache | subversion | >= 0 < 1.4.4dfsg1-1 | 1.4.4dfsg1-1 |
| apache | subversion | >= 0 < 1.4.4dfsg1-1 | 1.4.4dfsg1-1 |
| apache | subversion | >= 0 < 1.4.4dfsg1-1 | 1.4.4dfsg1-1 |
| debian | subversion | < subversion 1.4.4dfsg1-1 (bookworm) | subversion 1.4.4dfsg1-1 (bookworm) |
| subversion | subversion | <= 1.4.3 | — |
CVSS provenance
nvdv2.02.1LOWAV:N/AC:H/Au:S/C:P/I:N/A:N
osv2.1LOW
vendor_apache2.1LOW
vendor_debian2.1LOW
vendor_redhat2.1LOW
vendor_ubuntu2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Subversion vulnerabilities
vendor_ubuntu·2011-02-01·CVSS 2.1
CVE-2007-2448 [LOW] Subversion vulnerabilities
Title: Subversion vulnerabilities
It was discovered that Subversion incorrectly handled certain 'partial
access' privileges in rare scenarios. Remote authenticated users could use
this flaw to obtain sensitive information (revision properties). This issue
only applied to Ubuntu 6.06 LTS. (CVE-2007-2448)
It was discovered that the Subversion mod_dav_svn module for Apache did not
properly handle a named repository as a rule scope. Remote authenticated
users could use this flaw to bypass intended restrictions. This issue only
applied to Ubuntu 9.10, 10.04 LTS, and 10.10. (CVE-2010-3315)
It was discovered that the Subversion mod_dav_svn module for Apache
incorrectly handled the walk function. Remote authenticated users could use
this flaw to cause the service to crash, leading to a denial o
Red Hat
subversion: revision properties disclosure to user with partial access
vendor_redhat·2007-11-06·CVSS 2.1
CVE-2007-2448 [LOW] subversion: revision properties disclosure to user with partial access
subversion: revision properties disclosure to user with partial access
Subversion 1.4.3 and earlier does not properly implement the "partial access" privilege for users who have access to changed paths but not copied paths, which allows remote authenticated users to obtain sensitive information (revision properties) via svn (1) propget, (2) proplist, or (3) propedit.
Statement: The Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw.
Package: subversion (Red Hat Enterprise Linux 4) - Will not fix
Debian
CVE-2007-2448: subversion - Subversion 1.4.3 and earlier does not properly implement the "partial access" pr...
vendor_debian·2007·CVSS 2.1
CVE-2007-2448 [LOW] CVE-2007-2448: subversion - Subversion 1.4.3 and earlier does not properly implement the "partial access" pr...
Subversion 1.4.3 and earlier does not properly implement the "partial access" privilege for users who have access to changed paths but not copied paths, which allows remote authenticated users to obtain sensitive information (revision properties) via svn (1) propget, (2) proplist, or (3) propedit.
Scope: local
bookworm: resolved (fixed in 1.4.4dfsg1-1)
bullseye: resolved (fixed in 1.4.4dfsg1-1)
forky: resolved (fixed in 1.4.4dfsg1-1)
sid: resolved (fixed in 1.4.4dfsg1-1)
trixie: resolved (fixed in 1.4.4dfsg1-1)
Apache
Apache subversion: CVE-2007-2448
vendor_apache·CVSS 2.1
CVE-2007-2448 [LOW] Apache subversion: CVE-2007-2448
Apache subversion: CVE-2007-2448
-advisory.txt 1.0.1-1.4.3 Revision metadata leakage via 'svn prop*' commands.
GHSA
GHSA-5qx7-4v6g-86g4: Subversion 1
ghsa_unreviewed·2022-05-01
CVE-2007-2448 [LOW] GHSA-5qx7-4v6g-86g4: Subversion 1
Subversion 1.4.3 and earlier does not properly implement the "partial access" privilege for users who have access to changed paths but not copied paths, which allows remote authenticated users to obtain sensitive information (revision properties) via svn (1) propget, (2) proplist, or (3) propedit.
OSV
CVE-2007-2448: Subversion 1
osv·2007-06-14·CVSS 2.1
CVE-2007-2448 [LOW] CVE-2007-2448: Subversion 1
Subversion 1.4.3 and earlier does not properly implement the "partial access" privilege for users who have access to changed paths but not copied paths, which allows remote authenticated users to obtain sensitive information (revision properties) via svn (1) propget, (2) proplist, or (3) propedit.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2007-2448 New subversion release fixes a subtle security bug [F7]
bugzilla·2007-06-12·CVSS 2.1
CVE-2007-2448 [LOW] CVE-2007-2448 New subversion release fixes a subtle security bug [F7]
CVE-2007-2448 New subversion release fixes a subtle security bug [F7]
F7 tracking bug: see blocks bug list for full details of the security issue(s).
Discussion:
subversion-1.4.4-1.fc7 has been pushed to the Fedora 7 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
su -c 'yum --enablerepo=updates-testing update subversion'
---
subversion-1.4.4-1.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.
Bugzilla
CVE-2007-2448 New subversion release fixes a subtle security bug [FC5]
bugzilla·2007-06-12·CVSS 2.1
CVE-2007-2448 [LOW] CVE-2007-2448 New subversion release fixes a subtle security bug [FC5]
CVE-2007-2448 New subversion release fixes a subtle security bug [FC5]
FC5 tracking bug: see blocks bug list for full details of the security issue(s).
Bugzilla
CVE-2007-2448 New subversion release fixes a subtle security bug [FC6]
bugzilla·2007-06-12·CVSS 2.1
CVE-2007-2448 [LOW] CVE-2007-2448 New subversion release fixes a subtle security bug [FC6]
CVE-2007-2448 New subversion release fixes a subtle security bug [FC6]
FC6 tracking bug: see blocks bug list for full details of the security issue(s).
Discussion:
Fedora Core 6 has reached End of Life and is no longer supported. Supported
versions of Fedora are already fixed.
Bugzilla
CVE-2007-2448 subversion: revision properties disclosure to user with partial access
bugzilla·2007-06-11·CVSS 2.1
CVE-2007-2448 [LOW] CVE-2007-2448 subversion: revision properties disclosure to user with partial access
CVE-2007-2448 subversion: revision properties disclosure to user with partial access
Description of problem:
If someone would copy a file from a restricted part of the repository to an
unrestricted part, the revision properties of that commit would become
unrestricted.
Discussion:
Upstream advisory with further details:
http://subversion.tigris.org/security/CVE-2007-2448-advisory.txt
Fixed in upstream version: 1.4.4
---
*** Bug 242041 has been marked as a duplicate of this bug. ***
---
Reporter changed to [email protected] by request of Jay Turner.
---
This was fixed in RHEL5 by RHEA-2010:9860 when subversion was upgraded to version 1.6.11.
Given the limited life left for RHEL4, and the extremely low severity of this issue, I'm closing this bug as WONTFIX.
http://osvdb.org/36070http://secunia.com/advisories/43139http://securitytracker.com/id?1018237http://subversion.tigris.org/security/CVE-2007-2448-advisory.txthttp://www.securityfocus.com/bid/24463http://www.ubuntu.com/usn/USN-1053-1http://www.vupen.com/english/advisories/2007/2230http://www.vupen.com/english/advisories/2011/0264https://issues.rpath.com/browse/RPL-1896http://osvdb.org/36070http://secunia.com/advisories/43139http://securitytracker.com/id?1018237http://subversion.tigris.org/security/CVE-2007-2448-advisory.txthttp://www.securityfocus.com/bid/24463http://www.ubuntu.com/usn/USN-1053-1http://www.vupen.com/english/advisories/2007/2230http://www.vupen.com/english/advisories/2011/0264https://issues.rpath.com/browse/RPL-1896
2007-06-14
Published