Apache Subversion < 1.6.23 / 1.7.x < 1.7.10 Multiple Vulnerabilities

High Nessus Network Monitor Plugin ID 6854


The remote host is running a version of Apache Subversion that is vulnerable to multiple attack vectors.


Versions of Apache Subversion prior to 1.6.23, or 1.7.x prior to 1.7.10 are affected by the following vulnerabilities :

- Remote denial-of-service vulnerabilities exist due to an error in the 'svnserve' server, as it does not properly handle aborted connection messages. (CVE-2013-1968, CVE-2013-2112)
- A command injection vulnerability exists in the 'svn-keyword-check.pl' hook script while processing filenames. (CVE-2013-2088)


Upgrade to Apache Subversion 1.7.10 or later. If 1.7.x cannot be obtained, 1.6.23 is also patched for these vulnerabilities.

See Also




Plugin Details

Severity: High

ID: 6854

Family: Web Servers

Published: 2013/06/04

Modified: 2018/09/16

Dependencies: 8971

Nessus ID: 66890

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSS v3.0

Base Score: 7.5

Temporal Score: 6.5


Temporal Vector: CVSS3#E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:apache:subversion

Patch Publication Date: 2013/06/03

Vulnerability Publication Date: 2013/06/03

Reference Information

CVE: CVE-2013-2112, CVE-2013-2088, CVE-2013-1968

BID: 60264, 60265, 60267