{"id":"CVE-2013-4505","aliases":["DEBIAN-CVE-2013-4505","EUVD-2013-4366","GHSA-cr4v-cvvq-g798","MGASA-2013-0360","SUSE-SU-2015:0709-1","openSUSE-SU-2024:10538-1"],"status":"published","title":"The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0...","description":"The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service (resource consumption) via a relative URL in a REPORT request.","severity":{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.07858,"percentile":0.9474,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2013-11-30T21:37:01Z","modified":"2026-09-01T20:03:18Z","fixes":[{"ecosystem":"Debian:12","package":"subversion","fixed_in":["1.7.14-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"subversion","fixed_in":["1.7.14-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"subversion","fixed_in":["1.7.14-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.14-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.14-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.14-1"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.14-1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5-1.1"}]}],"bundled":37}],"products":[{"vendor":"apache","product":"mod_dontdothat"},{"vendor":"apache","product":"subversion"}],"references":[{"url":"http://secunia.com/advisories/55855","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://subversion.apache.org/security/CVE-2013-4505-advisory.txt","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://osvdb.org/100364","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-12/msg00029.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-12/msg00048.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4505"},{"url":"https://github.com/advisories/GHSA-cr4v-cvvq-g798"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4505","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0360.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11780","tags":["report"]},{"url":"http://subversion.apache.org/security/CVE-2013-4558-advisory.txt","tags":["advisory"]},{"url":"https://mail-archives.apache.org/mod_mbox/subversion-dev/201311.mbox/%3C52937FE1.2030700@apache.org%3E","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150709-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/813913","tags":["report"]},{"url":"https://bugzilla.suse.com/821505","tags":["report"]},{"url":"https://bugzilla.suse.com/834014","tags":["report"]},{"url":"https://bugzilla.suse.com/836245","tags":["report"]},{"url":"https://bugzilla.suse.com/841205","tags":["report"]},{"url":"https://bugzilla.suse.com/850667","tags":["report"]},{"url":"https://bugzilla.suse.com/862459","tags":["report"]},{"url":"https://bugzilla.suse.com/889849","tags":["report"]},{"url":"https://bugzilla.suse.com/909935","tags":["report"]},{"url":"https://bugzilla.suse.com/910376","tags":["report"]},{"url":"https://bugzilla.suse.com/923794","tags":["report"]},{"url":"https://bugzilla.suse.com/923795","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0251","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-4644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8734","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-4505","description":"The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service (resource consumption) via a relative URL in a REPORT request.","status":"published","published":"2013-12-07T20:00:00Z","modified":"2024-08-06T16:45:14.869Z","updated_at":"2026-11-02T14:34:57.869657Z"}],"euvd":[{"id":"EUVD-2013-4366","description":"The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service (resource consumption) via a relative URL in a REPORT request.","status":"published","published":"2013-12-07T20:00:00Z","modified":"2024-08-06T16:45:14Z","updated_at":"2026-11-03T01:56:31.667445Z"}],"ghsa":[{"id":"GHSA-cr4v-cvvq-g798","title":"The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0...","description":"The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service (resource consumption) via a relative URL in a REPORT request.","status":"published","published":"2022-05-17T04:56:00Z","modified":"2023-01-28T05:02:51Z","updated_at":"2026-11-02T14:43:51.685777Z"}],"nvd":[{"id":"CVE-2013-4505","description":"The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service (resource consumption) via a relative URL in a REPORT request.","status":"published","published":"2013-12-07T20:55:02.54Z","modified":"2026-06-16T23:57:20.967Z","cvss":[{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:44.596064Z"}],"osv":[{"id":"CVE-2013-4505","description":"The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service (resource consumption) via a relative URL in a REPORT request.","status":"published","published":"2013-12-07T20:55:02Z","modified":"2026-04-16T06:18:20.61306947Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-4505","description":"The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service (resource consumption) via a relative URL in a REPORT request.","status":"published","published":"2013-12-07T20:55:02.54Z","modified":"2026-09-01T20:03:18.288747993Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"MGASA-2013-0360","title":"Updated subversion package fixes security vulnerabilities","description":"mod_dontdothat allows you to block update REPORT requests against certain\npaths in the repository.  It expects the paths in the REPORT request to be\nabsolute URLs.  Serf based clients send relative URLs instead of absolute\nURLs in many cases.  As a result these clients are not blocked as\nconfigured by mod_dontdothat (CVE-2013-4505).\n\nWhen SVNAutoversioning is enabled via \"SVNAutoversioning on\", commits can\nbe made by single HTTP requests such as MKCOL and PUT.  If Subversion is\nbuilt with assertions enabled any such requests that have non-canonical\nURLs, such  as URLs with a trailing /, may trigger an assert.  An assert\nwill cause the Apache process to abort (CVE-2013-4558).\n","status":"published","published":"2013-11-30T21:37:01Z","modified":"2026-04-16T06:23:45.376672123Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10538-1","title":"libsvn_auth_gnome_keyring-1-0-1.9.5-1.1 on GA media","description":"These are all security issues fixed in the libsvn_auth_gnome_keyring-1-0-1.9.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:49:28.015865Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2015:0709-1","title":"Security update for subversion","description":"\nSubversion has been updated to fix a security problem:\n\n    * bnc#889849: Reveal authentication information through an md5\n      collision attack on authentication realm (CVE-2014-3528)\n\nSecurity Issues:\n\n    * CVE-2014-3528\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3528\u003e\n\n","status":"published","published":"2014-08-19T23:56:28Z","modified":"2026-02-04T03:24:28.875941Z","updated_at":"2026-11-02T15:53:41.276824Z"}]}}