« Volver al listado

CVE-2015-0202

Estado: ModificadaAlta (7.8)—

The mod_dav_svn server in Subversion 1.8.0 through 1.8.11 allows remote attackers to cause a denial of service (memory consumption) via a large number of REPORT requests, which trigger the traversal of FSFS repository nodes.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Apache — SubversionOpensuse — Opensuse

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-0202",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-04-08T18:59:00.077",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00008.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://subversion.apache.org/security/CVE-2015-0202-advisory.txt",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:192",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/76446",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1032100",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2721-1",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://security.gentoo.org/glsa/201610-05",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00008.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://subversion.apache.org/security/CVE-2015-0202-advisory.txt",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:192",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/76446",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1032100",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2721-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201610-05",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-399"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The mod_dav_svn server in Subversion 1.8.0 through 1.8.11 allows remote attackers to cause a denial of service (memory consumption) via a large number of REPORT requests, which trigger the traversal of FSFS repository nodes."
    },
    {
      "lang": "es",
      "value": "El servidor mod_dav_svn en Subversion 1.8.0 hasta 1.8.11 permite a atacantes remotos causar una denegación de servicio (consumo de memoria) a través de un número grande de solicitudes REPORT, lo que provoca el salto de nodos del repositorio FSFS."
    }
  ],
  "lastModified": "2026-06-17T00:19:42.693",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:subversion:1.8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC0E7811-3B60-46E7-943C-E0E7ED00FB01"
            },
            {
              "criteria": "cpe:2.3:a:apache:subversion:1.8.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A57A3347-6C48-4803-AB4E-A4BC0E6BFA41"
            },
            {
              "criteria": "cpe:2.3:a:apache:subversion:1.8.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50D26799-D038-470A-A468-58DBDB64A7E6"
            },
            {
              "criteria": "cpe:2.3:a:apache:subversion:1.8.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3769BD6-B104-4F74-B8C4-89398A8894FB"
            },
            {
              "criteria": "cpe:2.3:a:apache:subversion:1.8.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9757DD5E-42A6-44B8-9692-49690F60C8D1"
            },
            {
              "criteria": "cpe:2.3:a:apache:subversion:1.8.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A7B5A014-D4EE-4244-AABA-0873492F7295"
            },
            {
              "criteria": "cpe:2.3:a:apache:subversion:1.8.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CD9F8C2A-A94E-4D99-839B-47AAE8754191"
            },
            {
              "criteria": "cpe:2.3:a:apache:subversion:1.8.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69D29A9E-DB23-4D86-B4A3-3C4F663416AD"
            },
            {
              "criteria": "cpe:2.3:a:apache:subversion:1.8.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D86AEE89-9F8E-43A5-A888-F421B10DB2C7"
            },
            {
              "criteria": "cpe:2.3:a:apache:subversion:1.8.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D335628F-EC07-43BE-9B29-3365A6F64D71"
            },
            {
              "criteria": "cpe:2.3:a:apache:subversion:1.8.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4EF7D71-3AAF-4112-831A-3538C5B82594"
            },
            {
              "criteria": "cpe:2.3:a:apache:subversion:1.8.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "89835508-F72F-4D8A-8E4A-5CFAA5F90C24"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F"
            },
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}