Unscored severity · published Jan 21, 2009
CVE-2009-0240
listing.php in WebSVN 2.0 and possibly 1.7 beta, when using an SVN authz file, allows remote authenticated users to read changelogs or diffs for restricted projects via a modified…
–
CVSS
1.6%
EPSS
No
On KEV
Description
listing.php in WebSVN 2.0 and possibly 1.7 beta, when using an SVN authz file, allows remote authenticated users to read changelogs or diffs for restricted projects via a modified repname parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Websvn · Tigris
2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-0240
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-0240
bugs.debian.org
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512191
Vendor Advisory
http://secunia.com/advisories/32338
secunia.com
http://secunia.com/advisories/33945
secunia.com
http://secunia.com/advisories/34191
www.debian.org
http://www.debian.org/security/2009/dsa-1725
www.gentoo.org
http://www.gentoo.org/security/en/glsa/glsa-200903-20.xml
More from Websvn
–
CVE-2008-5920
The create_anchors function in utils.inc in WebSVN 1.x allows remote attackers to execute arbitrary PHP code via a crafted username that is processed by the preg_replace function…
–
CVE-2008-5919
Directory traversal vulnerability in rss.php in WebSVN 2.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to overwrite arbitrary files via directory…
–
CVE-2008-5918
Cross-site scripting (XSS) vulnerability in the getParameterisedSelfUrl function in index.php in WebSVN 2.0 and earlier allows remote attackers to inject arbitrary web script or…