Vulnerability record · CVE-2013-1847 · published 2 May 2013
CVE-2013-1847: Subversion mod_dav_svn NULL pointer dereference via anonymous LOCK
Apache · Subversion
The mod_dav_svn Apache HTTPD module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 dereferences a NULL pointer when handling an anonymous LOCK request for a URL that does not exist. A remote unauthenticated attacker can crash the server process, causing a denial of service on the Subversion HTTP service.
Description
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist.
AV:N/AC:L/Au:N/C:N/I:N/A:P
Automated analysis
medium priorityThe flaw is remotely reachable without authentication and has very high EPSS, but it only causes a denial of service with no confidentiality or integrity impact.
What it is
The mod_dav_svn Apache HTTPD module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 dereferences a NULL pointer when handling an anonymous LOCK request for a URL that does not exist. A remote unauthenticated attacker can crash the server process, causing a denial of service on the Subversion HTTP service.
Impact
An attacker gains no data access or code execution; the effect is a server crash that disrupts availability of the Subversion repository service for other users.
Attack surface
Reached over the network through the Apache HTTPD server hosting mod_dav_svn; the CVSS vector AV:N/AC:L/Au:N indicates no authentication is required, and the description states the LOCK is anonymous, so no user interaction is needed.
Exploitation
Not listed in CISA KEV and no reference carries an exploit tag, but EPSS is 0.51442 (98.9th percentile), indicating a high modeled likelihood of exploitation activity.
What to do
- Upgrade Subversion to a release later than 1.6.20 or 1.7.8, or apply the vendor patch referenced in the Apache Subversion security advisory for CVE-2013-1847.
- Apply the distribution errata for affected packages (Red Hat RHSA-2013-0737, Ubuntu USN-1893-1, openSUSE and Mandriva advisories).
- If patching is delayed, restrict or disable anonymous LOCK access to mod_dav_svn repositories via Apache authorization configuration.
- Monitor and rate-limit LOCK requests to nonexistent repository paths at the reverse proxy or web server layer.
Detection
- Inspect Apache access logs for LOCK requests returning 500 errors or targeting paths that do not exist in the repository.
- Alert on repeated anonymous LOCK requests from a single source IP within a short window.
- Monitor for Apache child process crashes or restarts correlated with LOCK method traffic.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2013-1847 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-1847), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
