Description
listing.php in WebSVN 2.0 and possibly 1.7 beta, when using an SVN authz file, allows remote authenticated users to read changelogs or diffs for restricted projects via a modified repname parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | websvn | 2.0-4+lenny1 | DSA-1725-1 |
Advisories 1
- DSA-1725-1 websvn - information leak Debian Security (DSA / DLA) · Mar 9, 2026
References
- 33945 third-party-advisory
- 34191 third-party-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512191
- GLSA-200903-20 vendor-advisory
- websvn-listing-information-disclosure(48171) vdb-entry
- [oss-security] 20090118 CVE request: WebSVN mailing-list
- 32338 third-party-advisory
- DSA-1725 vendor-advisory