← Vulnerability feed

Vulnerability record · CVE-2007-2448 · published 14 June 2007

CVE-2007-2448: Subversion vulnerability

Subversion · Subversion

Subversion 1.4.3 and earlier does not properly implement the "partial access" privilege for users who have access to changed paths but not copied paths, which allows remote authenticated users to obtain sensitive information (revision properties) via svn (1) propget, (2) proplist, or (3) propedit.

2.1 CVSS 2.0 Low EPSS 1.5% · top 26.4%
2.1CVSS 2.0 base score
1.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
18References
16 Jun 2026Last modified by NVD

Description

Subversion 1.4.3 and earlier does not properly implement the "partial access" privilege for users who have access to changed paths but not copied paths, which allows remote authenticated users to obtain sensitive information (revision properties) via svn (1) propget, (2) proplist, or (3) propedit.

AV:N/AC:H/Au:S/C:P/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://osvdb.org/36070
http://secunia.com/advisories/43139
http://securitytracker.com/id?1018237 Patch
http://subversion.tigris.org/security/CVE-2007-2448-advisory.txt
http://www.securityfocus.com/bid/24463 Patch
http://www.ubuntu.com/usn/USN-1053-1
http://www.vupen.com/english/advisories/2007/2230
http://www.vupen.com/english/advisories/2011/0264
https://issues.rpath.com/browse/RPL-1896
http://osvdb.org/36070
http://secunia.com/advisories/43139
http://securitytracker.com/id?1018237 Patch
http://subversion.tigris.org/security/CVE-2007-2448-advisory.txt
http://www.securityfocus.com/bid/24463 Patch
http://www.ubuntu.com/usn/USN-1053-1
http://www.vupen.com/english/advisories/2007/2230
http://www.vupen.com/english/advisories/2011/0264
https://issues.rpath.com/browse/RPL-1896

Track CVE-2007-2448 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2004-0413Openpkg vulnerabilitylibsvn_ra_svn in Subversion 1.0.4 trusts the length field of (1) svn://, (2) svn+ssh://, and (3) other svn protocol URL strings, which allows remote …EPSS 5.9%8.5CVE-2009-2411Subversion vulnerabilityMultiple integer overflows in the libsvn_delta library in Subversion before 1.5.7, and 1.6.x before 1.6.4, allow remote authenticated users and remot…EPSS 5.1%7.5CVE-2004-0397Subversion apr_time_t conversion stack buffer overflowSubversion 1.0.2 and earlier contains a stack-based buffer overflow in the apr_time_t data conversion routine. A remote attacker can trigger it throu…EPSS 75%analysed6.0CVE-2007-3846Subversion path traversal vulnerabilityDirectory traversal vulnerability in Subversion before 1.4.5, as used by TortoiseSVN before 1.4.5 and possibly other products, when run on Windows-ba…EPSS 1.6%5.0CVE-2004-0749Subversion vulnerabilityThe mod_authz_svn module in Subversion 1.0.7 and earlier does not properly restrict access to all metadata on unreadable paths, which could allow rem…EPSS 1.5%2.1CVE-2004-1438Subversion vulnerabilityThe mod_authz_svn Apache module for Subversion 1.0.4-r1 and earlier allows remote authenticated users, with write access to the repository, to read u…EPSS 0.70%

Source: NIST National Vulnerability Database (record CVE-2007-2448), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.