Insufficient Verification of Data Authenticity Affecting mod_dav_svn package, versions <0:1.6.11-15.el6_7


Severity

Recommended
0.0
medium
0
10

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.61% (79th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE6-MODDAVSVN-2500711
  • published10 Apr 2022
  • disclosed8 Apr 2015

Introduced: 8 Apr 2015

CVE-2015-0251  (opens in a new tab)
CWE-345  (opens in a new tab)

How to fix?

Upgrade Oracle:6 mod_dav_svn to version 0:1.6.11-15.el6_7 or higher.
This issue was patched in ELSA-2015-1633.

NVD Description

Note: Versions mentioned in the description apply only to the upstream mod_dav_svn package and not the mod_dav_svn package as distributed by Oracle. See How to fix? for Oracle:6 relevant fixed versions and status.

The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protocol request sequences.

CVSS Scores

version 3.1