{"id":"CVE-2013-2088","aliases":["DEBIAN-CVE-2013-2088","EUVD-2013-2063","GHSA-92h8-fm5h-34jg","openSUSE-SU-2024:10538-1"],"status":"published","title":"contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated...","description":"contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands via shell metacharacters in a filename.","severity":{"version":"2.0","score":7.1,"vector":"AV:N/AC:H/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.31466,"percentile":0.98297,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2013-07-31T10:00:00Z","modified":"2026-09-01T20:03:15Z","exploits":[{"source":"exploitdb","id":"EDB-40507","title":"Subversion 1.6.6/1.6.12 - Code Execution","type":"remote","platform":"linux","date":"2016-10-12","url":"https://www.exploit-db.com/exploits/40507"}],"fixes":[{"ecosystem":"Debian:12","package":"subversion","fixed_in":["1.7.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"subversion","fixed_in":["1.7.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"subversion","fixed_in":["1.7.5-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5-1.1"}]}],"bundled":37}],"products":[{"vendor":"apache","product":"subversion"},{"vendor":"collabnet","product":"subversion"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"http://mail-archives.apache.org/mod_mbox/subversion-announce/201305.mbox/%3CCADkdwvTxsMFeHgc8bK2V-2PrSrKoBffTi8%2BxbHA5tocrrewWew%40mail.gmail.com%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://mail-archives.apache.org/mod_mbox/subversion-announce/201305.mbox/%3CCADkdwvRK51pQsybfvsAzjxQJrmVpL0fEa1K4WGkUP9Tzz6KFDw%40mail.gmail.com%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://subversion.apache.org/security/CVE-2013-2088-advisory.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18772","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"https://www.exploit-db.com/exploits/40507/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-07/msg00015.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2088"},{"url":"https://www.exploit-db.com/exploits/40507"},{"url":"https://github.com/advisories/GHSA-92h8-fm5h-34jg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-2088","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-4644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8734","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-2088","description":"contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands via shell metacharacters in a filename.","status":"published","published":"2013-07-31T10:00:00Z","modified":"2024-08-06T15:27:40.65Z","updated_at":"2026-11-02T14:34:55.825574Z"}],"euvd":[{"id":"EUVD-2013-2063","description":"contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands via shell metacharacters in a filename.","status":"published","published":"2013-07-31T10:00:00Z","modified":"2024-08-06T15:27:40Z","updated_at":"2026-11-03T01:56:39.604617Z"}],"ghsa":[{"id":"GHSA-92h8-fm5h-34jg","title":"contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated...","description":"contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands via shell metacharacters in a filename.","status":"published","published":"2022-05-14T02:11:28Z","modified":"2025-04-11T04:13:34Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:14.490744Z"}],"nvd":[{"id":"CVE-2013-2088","description":"contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands via shell metacharacters in a filename.","status":"published","published":"2013-07-31T13:20:24.71Z","modified":"2026-06-16T23:52:43.517Z","cvss":[{"version":"2.0","score":7.1,"vector":"AV:N/AC:H/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:31.592595Z"}],"osv":[{"id":"CVE-2013-2088","description":"contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands via shell metacharacters in a filename.","status":"published","published":"2013-07-31T13:20:24Z","modified":"2026-04-10T03:44:25.714889Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-2088","description":"contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands via shell metacharacters in a filename.","status":"published","published":"2013-07-31T13:20:24.71Z","modified":"2026-09-01T20:03:15.579112839Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"openSUSE-SU-2024:10538-1","title":"libsvn_auth_gnome_keyring-1-0-1.9.5-1.1 on GA media","description":"These are all security issues fixed in the libsvn_auth_gnome_keyring-1-0-1.9.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:49:28.015865Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}