WebSVN Multiple Remote Input Validation Vulnerabilities

Bugtraq ID:	31891
Class:	Input Validation Error
CVE:	CVE-2008-5918 CVE-2008-5919 CVE-2008-5920
Remote:	Yes
Local:	No
Published:	Oct 23 2008 12:00AM
Updated:	Jul 05 2016 10:01PM
Credit:	James Bercegay from GulfTech Security Research Team
Vulnerable:	WebSVN WebSVN 2.0 WebSVN WebSVN 1.0 Gentoo Linux
Not Vulnerable:

WebSVN Multiple Remote Input Validation Vulnerabilities

WebSVN is prone to multiple remote input-validation vulnerabilities:

1. A command-execution issue.

2. A cross-site scripting issue.

3. A directory-traversal issue.

Exploiting these issues could allow an attacker to view sensitive information, execute arbitrary script code within the context of the application, or steal cookie-based authentication credentials. Other attacks are also possible.

The command-execution vulnerability affects the WebSVN 1.0 branch; the remaining issues affect WebSVN 2.0. Other versions may also be vulnerable.

WebSVN Multiple Remote Input Validation Vulnerabilities

An attacker can exploit these issues with a web browser.

The following example URIs and regular expression are available:

• /data/vulnerabilities/exploits/31891.txt

WebSVN Multiple Remote Input Validation Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

WebSVN Multiple Remote Input Validation Vulnerabilities

References:

• WebSVN <= 2.0 Multiple Vulnerabilities (James Bercegay)
  
• WebSVN Homepage (WebSVN)