CVE-2024-45720

CWE-78 — OS Command Injection7 documents7 sources

Severity

7.8HIGH

EPSS

0.1%

top 77.91%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apache Subversion Apache Software Foundation Apache Subversion

Timeline

PublishedOct 9

Description

On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables (e.g., svn.exe, etc.) may lead to unexpected command line argument interpretation, including argument injection and execution of other programs, if a specially crafted command line argument string is processed. All versions of Subversion up to and including Subversion 1.14.3 are affected on Windows platforms only. Users are recommended to upgrade to version Subversion 1.14.4, w…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HExploitability: 1.5 | Impact: 6.0

Affected Packages3 packages

▶NVDapache/subversion< 1.14.4

▶Alpinesubversion< 1.14.5-r0+5

▶CVEListV5apache_software_foundation/apache_subversion1.0.0 — 1.14.3

🔴Vulnerability Details

OSV

CVE-2024-45720: On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables (e↗2024-10-09

▶

CVEList

Apache Subversion: Command line argument injection on Windows platforms↗2024-10-09

▶

GHSA

GHSA-86vm-fj76-qh69: On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables (e↗2024-10-09

▶

📋Vendor Advisories

Microsoft

Apache Subversion: Command line argument injection on Windows platforms↗2024-10-08

▶

Debian

CVE-2024-45720: subversion - On Windows platforms, a "best fit" character encoding conversion of command line...↗2024

▶

Apache

Apache subversion: CVE-2024-45720↗

▶