The vulnerability of the svn:externals and svn:sync-from-url services in the centralized version control system Subversion allows a perpetrator to execute arbitrary shell commands.

SVN externals and sync-from-url permit shell commands via crafted URLs due to input validation.

Reporter	Title	Published	Views	Family All 124
0day.today	Apache Subversion Arbitrary Code Execution Vulnerability	14 Aug 201700:00	–	zdt
0day.today	SourceTree Remote Code Execution Exploit	7 Sep 201700:00	–	zdt
IBM Security Bulletins	IBM Security Network Protection / IBM QRadar Network Security / XGS Technote Index	31 Jan 202100:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Security is affected by vulnerability in subversion (CVE-2017-9800)	16 Jun 201822:03	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in subversion affects PowerKVM	18 Jun 201801:38	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private	20 Jul 201818:56	–	ibm
FreeBSD	subversion -- Arbitrary code execution vulnerability	10 Aug 201700:00	–	freebsd
ATTACKERKB	CVE-2017-17459	7 Dec 201718:29	–	attackerkb
Amazon	Important: subversion, mod_dav_svn	31 Aug 201700:00	–	amazon
Tenable Nessus	Amazon Linux AMI : subversion / mod_dav_svn (ALAS-2017-883)	1 Sep 201700:00	–	nessus

Vulners

Node

apache subversionRange1.9–1.9.7

apache subversionRange1.10.0–1.10.0-alpha3

Source	Link
securityfocus	www.securityfocus.com/bid/100259
securitytracker	www.securitytracker.com/id/1039127
lists	www.lists.apache.org/thread.html/cb607dc2f13bab9769147759ddccb14a4f9d8e5cdcad5e99c0d03b63%3Cannounce.apache.org%3E
subversion	www.subversion.apache.org/security/CVE-2017-9800-advisory.txt
confluence	www.confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2017-08-11-933099891.html
web	www.web.nvd.nist.gov/view/vuln/detail

23 Mar 2021 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 27.5

EPSS0.18892