CVE-2011-2195

2021-10-2612:10:00

CWE-78

redhat

www.cve.org

9.8 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.1%

JSON

A flaw was found in WebSVN 2.3.2. Without prior authentication, if the ‘allowDownload’ option is enabled in config.php, an attacker can invoke the dl.php script and pass a well formed ‘path’ argument to execute arbitrary commands against the underlying operating system.

CNA Affected

[
  {
    "product": "websvn",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "websvn 2.3.2"
      }
    ]
  }
]

References

seclists.org/bugtraq/2011/Jun/34