← Vulnerability feed

Vulnerability record · CVE-2004-1438 · published 31 December 2004

CVE-2004-1438: Subversion vulnerability

Subversion · Subversion

The mod_authz_svn Apache module for Subversion 1.0.4-r1 and earlier allows remote authenticated users, with write access to the repository, to read unauthorized parts of the repository via the svn copy command.

2.1 CVSS 2.0 Low EPSS 0.70% · top 48.7%
2.1CVSS 2.0 base score
0.70%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References
16 Jun 2026Last modified by NVD

Description

The mod_authz_svn Apache module for Subversion 1.0.4-r1 and earlier allows remote authenticated users, with write access to the repository, to read unauthorized parts of the repository via the svn copy command.

AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://securityreason.com/securityalert/60
http://securitytracker.com/id?1010779
http://svn.collab.net/repos/svn/tags/1.0.6/CHANGES
http://www.gentoo.org/security/en/glsa/glsa-200407-20.xml Patch
http://www.securityfocus.com/bid/10800 Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/16803
http://securityreason.com/securityalert/60
http://securitytracker.com/id?1010779
http://svn.collab.net/repos/svn/tags/1.0.6/CHANGES
http://www.gentoo.org/security/en/glsa/glsa-200407-20.xml Patch
http://www.securityfocus.com/bid/10800 Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/16803

Track CVE-2004-1438 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2004-0413Openpkg vulnerabilitylibsvn_ra_svn in Subversion 1.0.4 trusts the length field of (1) svn://, (2) svn+ssh://, and (3) other svn protocol URL strings, which allows remote …EPSS 5.9%8.5CVE-2009-2411Subversion vulnerabilityMultiple integer overflows in the libsvn_delta library in Subversion before 1.5.7, and 1.6.x before 1.6.4, allow remote authenticated users and remot…EPSS 5.1%7.5CVE-2004-0397Subversion apr_time_t conversion stack buffer overflowSubversion 1.0.2 and earlier contains a stack-based buffer overflow in the apr_time_t data conversion routine. A remote attacker can trigger it throu…EPSS 75%analysed6.0CVE-2007-3846Subversion path traversal vulnerabilityDirectory traversal vulnerability in Subversion before 1.4.5, as used by TortoiseSVN before 1.4.5 and possibly other products, when run on Windows-ba…EPSS 1.6%5.0CVE-2004-0749Subversion vulnerabilityThe mod_authz_svn module in Subversion 1.0.7 and earlier does not properly restrict access to all metadata on unreadable paths, which could allow rem…EPSS 1.5%2.1CVE-2007-2448Subversion vulnerabilitySubversion 1.4.3 and earlier does not properly implement the "partial access" privilege for users who have access to changed paths but not copied pat…EPSS 1.5%

Source: NIST National Vulnerability Database (record CVE-2004-1438), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.