The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x…
Priority LOW 28CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- Partial Red Hat: 12 fixed, 1 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-200.
Summary
The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by reading the history of a node that has been moved from a hidden path.
Why it matters now
EPSS 0.06564 93rd percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 12 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:subversion:*:*:*:*:*:*:*:* | up to 1.7.20 | Vulnerable | Apache |
| cpe:2.3:a:apache:subversion:1.8.1:*:*:*:*:*:*:* | 1.8.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:subversion:1.8.2:*:*:*:*:*:*:* | 1.8.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:subversion:1.8.3:*:*:*:*:*:*:* | 1.8.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:subversion:1.8.4:*:*:*:*:*:*:* | 1.8.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:subversion:1.8.5:*:*:*:*:*:*:* | 1.8.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:subversion:1.8.6:*:*:*:*:*:*:* | 1.8.6 | Vulnerable | Apache |
| cpe:2.3:a:apache:subversion:1.8.7:*:*:*:*:*:*:* | 1.8.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:subversion:1.8.8:*:*:*:*:*:*:* | 1.8.8 | Vulnerable | Apache |
| cpe:2.3:a:apache:subversion:1.8.9:*:*:*:*:*:*:* | 1.8.9 | Vulnerable | Apache |
- cpe:2.3:a:apache:subversion:*:*:*:*:*:*:*:* Versions up to 1.7.20 Vulnerable ·Apache
- cpe:2.3:a:apache:subversion:1.8.1:*:*:*:*:*:*:* Versions 1.8.1 Vulnerable ·Apache
- cpe:2.3:a:apache:subversion:1.8.2:*:*:*:*:*:*:* Versions 1.8.2 Vulnerable ·Apache
- cpe:2.3:a:apache:subversion:1.8.3:*:*:*:*:*:*:* Versions 1.8.3 Vulnerable ·Apache
- cpe:2.3:a:apache:subversion:1.8.4:*:*:*:*:*:*:* Versions 1.8.4 Vulnerable ·Apache
- cpe:2.3:a:apache:subversion:1.8.5:*:*:*:*:*:*:* Versions 1.8.5 Vulnerable ·Apache
- cpe:2.3:a:apache:subversion:1.8.6:*:*:*:*:*:*:* Versions 1.8.6 Vulnerable ·Apache
- cpe:2.3:a:apache:subversion:1.8.7:*:*:*:*:*:*:* Versions 1.8.7 Vulnerable ·Apache
- cpe:2.3:a:apache:subversion:1.8.8:*:*:*:*:*:*:* Versions 1.8.8 Vulnerable ·Apache
- cpe:2.3:a:apache:subversion:1.8.9:*:*:*:*:*:*:* Versions 1.8.9 Vulnerable ·Apache
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:subversion:1.8.10:*:*:*:*:*:*:* | 1.8.10 | Vulnerable | Apache |
| cpe:2.3:a:apache:subversion:1.8.11:*:*:*:*:*:*:* | 1.8.11 | Vulnerable | Apache |
| cpe:2.3:a:apache:subversion:1.8.13:*:*:*:*:*:*:* | 1.8.13 | Vulnerable | Apache |
| cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:* | up to 7.2.1 | Vulnerable | Apple |
- cpe:2.3:a:apache:subversion:1.8.10:*:*:*:*:*:*:* Versions 1.8.10 Vulnerable ·Apache
- cpe:2.3:a:apache:subversion:1.8.11:*:*:*:*:*:*:* Versions 1.8.11 Vulnerable ·Apache
- cpe:2.3:a:apache:subversion:1.8.13:*:*:*:*:*:*:* Versions 1.8.13 Vulnerable ·Apache
- cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:* Versions up to 7.2.1 Vulnerable ·Apple
Remediation
Red Hat 2 advisories
- RHSA-2015:1742 Released 2015-09-08 · Red Hat rating Moderatesubversion security update
- Red Hat Enterprise Linux Client Optional (v. 7) mod_dav_svn-1.7.14-7.el7_1.1, subversion-1.7.14-7.el7_1.1, subversion-devel-1.7.14-7.el7_1.1 +8
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) mod_dav_svn-1.7.14-7.el7_1.1, subversion-1.7.14-7.el7_1.1, subversion-devel-1.7.14-7.el7_1.1 +8
- Red Hat Enterprise Linux Server (v. 7) mod_dav_svn-1.7.14-7.ael7b_1.1, mod_dav_svn-1.7.14-7.el7_1.1, subversion-1.7.14-7.ael7b_1.1 +4
- Red Hat Enterprise Linux Server Optional (v. 7) subversion-1.7.14-7.el7_1.1, subversion-1.7.14-7.el7_1.1.ppc, subversion-devel-1.7.14-7.ael7b_1.1 +21
- Red Hat Enterprise Linux Workstation (v. 7) mod_dav_svn-1.7.14-7.el7_1.1, subversion-1.7.14-7.el7_1.1, subversion-libs-1.7.14-7.el7_1.1
- Red Hat Enterprise Linux Workstation Optional (v. 7) subversion-1.7.14-7.el7_1.1, subversion-devel-1.7.14-7.el7_1.1, subversion-gnome-1.7.14-7.el7_1.1 +6
- RHSA-2015:1633 Released 2015-08-17 · Red Hat rating Moderatesubversion security update
- Red Hat Enterprise Linux Desktop Optional (v. 6) mod_dav_svn-1.6.11-15.el6_7, subversion-1.6.11-15.el6_7, subversion-devel-1.6.11-15.el6_7 +6
- Red Hat Enterprise Linux HPC Node Optional (v. 6) mod_dav_svn-1.6.11-15.el6_7, subversion-1.6.11-15.el6_7, subversion-devel-1.6.11-15.el6_7 +6
- Red Hat Enterprise Linux Server (v. 6) mod_dav_svn-1.6.11-15.el6_7, subversion-1.6.11-15.el6_7, subversion-1.6.11-15.el6_7.ppc +1
- Red Hat Enterprise Linux Server Optional (v. 6) subversion-devel-1.6.11-15.el6_7, subversion-devel-1.6.11-15.el6_7.ppc, subversion-gnome-1.6.11-15.el6_7 +10
- Red Hat Enterprise Linux Workstation (v. 6) mod_dav_svn-1.6.11-15.el6_7, subversion-1.6.11-15.el6_7, subversion-javahl-1.6.11-15.el6_7
- Red Hat Enterprise Linux Workstation Optional (v. 6) subversion-devel-1.6.11-15.el6_7, subversion-gnome-1.6.11-15.el6_7, subversion-kde-1.6.11-15.el6_7 +3
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2015:1742 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2015:1742 |
| Red Hat Enterprise Linux Desktop Optional (v. 6) | Fixed | RHSA-2015:1633 |
| Red Hat Enterprise Linux HPC Node Optional (v. 6) | Fixed | RHSA-2015:1633 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2015:1633 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2015:1742 |
| Red Hat Enterprise Linux Server Optional (v. 6) | Fixed | RHSA-2015:1633 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2015:1742 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2015:1633 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2015:1742 |
| Red Hat Enterprise Linux Workstation Optional (v. 6) | Fixed | RHSA-2015:1633 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2015:1742 |
Timeline
- 2026-10-02 Threatist record created from CVE-2015-3187
- 2026-10-03 Alias added: GHSA-c79q-h5wc-3724
References
Sources
- CVE-2015-3187 · CVE Program
- CVE-2015-3187 · NVD
- FIRST EPSS
- GHSA-c79q-h5wc-3724 · GitHub Advisory Database · CC BY 4.0
- CVE-2015-3187 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences