{"id":"CVE-2007-2448","aliases":["DEBIAN-CVE-2007-2448","EUVD-2007-2443","GHSA-5qx7-4v6g-86g4","RHEA-2011:0039","openSUSE-SU-2024:11412-1"],"status":"published","title":"Subversion 1.4.3 and earlier does not properly implement the \"partial access\" privilege for users...","description":"Subversion 1.4.3 and earlier does not properly implement the \"partial access\" privilege for users who have access to changed paths but not copied paths, which allows remote authenticated users to obtain sensitive information (revision properties) via svn (1) propget, (2) proplist, or (3) propedit.","severity":{"version":"2.0","score":2.1,"vector":"AV:N/AC:H/Au:S/C:P/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01525,"percentile":0.74854,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2007-06-14T23:00:00Z","modified":"2026-10-21T17:47:36Z","fixes":[{"ecosystem":"Debian:12","package":"subversion","fixed_in":["1.4.4dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"subversion","fixed_in":["1.4.4dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"subversion","fixed_in":["1.4.4dfsg1-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"mod_dav_svn","fixed_in":["0:1.6.11-7.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"subversion","fixed_in":["0:1.6.11-7.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"subversion-debuginfo","fixed_in":["0:1.6.11-7.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"subversion-devel","fixed_in":["0:1.6.11-7.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"subversion-javahl","fixed_in":["0:1.6.11-7.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"subversion-perl","fixed_in":["0:1.6.11-7.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"subversion-ruby","fixed_in":["0:1.6.11-7.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"mod_dav_svn","fixed_in":["0:1.6.11-7.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"subversion","fixed_in":["0:1.6.11-7.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"subversion-debuginfo","fixed_in":["0:1.6.11-7.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"subversion-devel","fixed_in":["0:1.6.11-7.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"subversion-javahl","fixed_in":["0:1.6.11-7.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"subversion-perl","fixed_in":["0:1.6.11-7.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"subversion-ruby","fixed_in":["0:1.6.11-7.el5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4dfsg1-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"mod_dav_svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-7.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-7.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"subversion-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-7.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"subversion-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-7.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"subversion-javahl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-7.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"subversion-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-7.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"subversion-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-7.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"mod_dav_svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-7.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-7.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"subversion-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-7.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"subversion-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-7.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"subversion-javahl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-7.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"subversion-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-7.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"subversion-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-7.el5"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-1.11"}]}],"bundled":6}],"products":[{"vendor":"subversion","product":"subversion"}],"references":[{"url":"https://issues.rpath.com/browse/RPL-1896","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://osvdb.org/36070","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://www.vupen.com/english/advisories/2011/0264","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://subversion.tigris.org/security/CVE-2007-2448-advisory.txt","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://www.vupen.com/english/advisories/2007/2230","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-1053-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://securitytracker.com/id?1018237","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Patch","fix"]},{"url":"http://secunia.com/advisories/43139","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/24463","tags":["vdb-entry","x_refsource_BID","x_transferred","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-2448","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5qx7-4v6g-86g4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2007-2448","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHEA-2011:0039","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=521900","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhea-2011_0039.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-2448","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=243757","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-2448","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17525","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2007-2448","description":"Subversion 1.4.3 and earlier does not properly implement the \"partial access\" privilege for users who have access to changed paths but not copied paths, which allows remote authenticated users to obtain sensitive information (revision properties) via svn (1) propget, (2) proplist, or (3) propedit.","status":"published","published":"2007-06-14T23:00:00Z","modified":"2024-08-07T13:42:33.422Z","updated_at":"2026-11-02T13:32:11.910312Z"}],"euvd":[{"id":"EUVD-2007-2443","description":"Subversion 1.4.3 and earlier does not properly implement the \"partial access\" privilege for users who have access to changed paths but not copied paths, which allows remote authenticated users to obtain sensitive information (revision properties) via svn (1) propget, (2) proplist, or (3) propedit.","status":"published","published":"2007-06-14T23:00:00Z","modified":"2024-08-07T13:42:33Z","updated_at":"2026-11-03T01:38:20.980728Z"}],"ghsa":[{"id":"GHSA-5qx7-4v6g-86g4","title":"Subversion 1.4.3 and earlier does not properly implement the \"partial access\" privilege for users...","description":"Subversion 1.4.3 and earlier does not properly implement the \"partial access\" privilege for users who have access to changed paths but not copied paths, which allows remote authenticated users to obtain sensitive information (revision properties) via svn (1) propget, (2) proplist, or (3) propedit.","status":"published","published":"2022-05-01T18:03:36Z","modified":"2023-01-31T05:03:38Z","updated_at":"2026-11-02T14:48:30.831549Z"}],"nvd":[{"id":"CVE-2007-2448","description":"Subversion 1.4.3 and earlier does not properly implement the \"partial access\" privilege for users who have access to changed paths but not copied paths, which allows remote authenticated users to obtain sensitive information (revision properties) via svn (1) propget, (2) proplist, or (3) propedit.","status":"published","published":"2007-06-14T23:30:00Z","modified":"2026-06-16T22:39:37.323Z","cvss":[{"version":"2.0","score":2.1,"vector":"AV:N/AC:H/Au:S/C:P/I:N/A:N","level":"low","assessor":"primary"}],"updated_at":"2026-11-02T14:01:16.479378Z"}],"osv":[{"id":"CVE-2007-2448","description":"Subversion 1.4.3 and earlier does not properly implement the \"partial access\" privilege for users who have access to changed paths but not copied paths, which allows remote authenticated users to obtain sensitive information (revision properties) via svn (1) propget, (2) proplist, or (3) propedit.","status":"published","published":"2007-06-14T23:30:00Z","modified":"2026-04-10T03:38:53.924134Z","updated_at":"2026-11-02T15:43:56.865964Z"},{"id":"DEBIAN-CVE-2007-2448","description":"Subversion 1.4.3 and earlier does not properly implement the \"partial access\" privilege for users who have access to changed paths but not copied paths, which allows remote authenticated users to obtain sensitive information (revision properties) via svn (1) propget, (2) proplist, or (3) propedit.","status":"published","published":"2007-06-14T23:30:00Z","modified":"2026-10-21T17:47:36.56957638Z","updated_at":"2026-11-02T15:45:23.411908Z"},{"id":"openSUSE-SU-2024:11412-1","title":"libsvn_auth_gnome_keyring-1-0-1.14.1-1.11 on GA media","description":"These are all security issues fixed in the libsvn_auth_gnome_keyring-1-0-1.14.1-1.11 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:34:43.120418Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"RHEA-2011:0039","title":"Red Hat Enhancement Advisory: subversion enhancement update","status":"published","published":"2024-09-15T18:35:10Z","modified":"2026-06-26T10:15:04Z","updated_at":"2026-11-02T15:52:58.636919Z"}]}}