mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
| AND |
|
History
21 Nov 2024, 02:28
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://lists.apple.com/archives/security-announce/2016/Mar/msg00003.html - | |
| References | () http://lists.opensuse.org/opensuse-updates/2015-08/msg00022.html - | |
| References | () http://rhn.redhat.com/errata/RHSA-2015-1742.html - | |
| References | () http://subversion.apache.org/security/CVE-2015-3184-advisory.txt - Vendor Advisory | |
| References | () http://www.debian.org/security/2015/dsa-3331 - | |
| References | () http://www.securityfocus.com/bid/76274 - | |
| References | () http://www.securitytracker.com/id/1033215 - | |
| References | () http://www.ubuntu.com/usn/USN-2721-1 - | |
| References | () https://security.gentoo.org/glsa/201610-05 - | |
| References | () https://support.apple.com/HT206172 - Vendor Advisory |
Information
Published : 2015-08-12 14:59
Updated : 2024-11-21 02:28
NVD link : CVE-2015-3184
Mitre link : CVE-2015-3184
CVE.ORG link : CVE-2015-3184
JSON object : View
Products Affected
apache
- subversion
- http_server
apple
- xcode
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor