CVE-2013-7393 — Link Following in Apache Subversion

CWE-59 — Link Following8 documents7 sources
Severity
2.4LOWNVD
EPSS
0.2%
top 61.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Apache Subversion
Timeline
PublishedJul 28
Latest updateMay 17

Description

The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges via a symlink attack on the pid file created for (1) svnwcsub.py or (2) irkerbridge.py when the --pidfile option is used. NOTE: this issue was SPLIT from CVE-2013-4262 based on different affected versions (ADT3).

CVSS vector

AV:L/AC:H/C:N/I:P/A:PExploitability: 1.5 | Impact: 4.9

Affected Packages2 packages

▶Debianapache/subversion< 1.8.5-1+3
▶NVDapache/subversion1.8.0, 1.8.1+1

🔴Vulnerability Details

3
GHSA
GHSA-vgr5-m78w-8rc3: The daemonize↗2022-05-17
▶
OSV
CVE-2013-7393: The daemonize↗2014-07-28
▶
CVEList
CVE-2013-7393: The daemonize↗2014-07-28
▶

📋Vendor Advisories

3
Red Hat
subversion: svnwcsub.py and irkerbridge.py are vulnerable to symlink attack↗2013-08-30
▶
Red Hat
subversion: svnwcsub.py and irkerbridge.py are vulnerable to symlink attack↗2013-08-30
▶
Debian
CVE-2013-7393: subversion - The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to g...↗2013
▶

💬Community

1
Bugzilla
CVE-2013-4262 CVE-2013-7393 subversion: svnwcsub.py and irkerbridge.py are vulnerable to symlink attack↗2013-08-22
▶
CVE-2013-7393 — Link Following in Apache Subversion | cvebase