Vulnerability record · CVE-2024-45720 · published 9 October 2024

CVE-2024-45720: Apache subversion os command injection vulnerability

Apache · Subversion

On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables (e.g., svn.exe, etc.) may lead to unexpected command line argument interpretation, including argument injection and execution of other programs, if a specially crafted command line argument string is processed. All versions of Subversion up to and including Subversion 1.14.3 are affected on Windows platforms only. Users are recommended to upgrade to version Subversion 1.14.4, which fixes this issue. Subversion is not affected on UNIX-like platforms.

7.8 CVSS 3.1 High EPSS 0.61% · top 52.9% CWE-78 · OS command injection

7.8CVSS 3.1 base score

0.61%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Subversion Apache

References

Link	Tags
https://subversion.apache.org/security/CVE-2024-45720-advisory.txt	Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/10/08/3	Mailing List

Track CVE-2024-45720 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2017-9800Apache subversion improper input validation vulnerabilityA maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run …EPSS 19%11 Aug 2017 8.8CVE-2013-4246Apache subversion improper access control vulnerabilitylibsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated users with commit access to corrupt FSFS repositories a…EPSS 2.8%30 Oct 2017 8.6CVE-2015-5259Apache Subversion svn:// protocol integer overflow enables remote code executionApache Subversion 1.9.x before 1.9.3 has an integer overflow in the read_string function in libsvn_ra_svn/marshal.c. A crafted svn:// protocol string…EPSS 57%analysed8 Jan 2016 7.8CVE-2015-0202Apache subversion vulnerabilityThe mod_dav_svn server in Subversion 1.8.0 through 1.8.11 allows remote attackers to cause a denial of service (memory consumption) via a large numbe…EPSS 8.0%8 Apr 2015 7.8CVE-2013-2112Apache subversion vulnerabilityThe svnserve server in Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote attackers to cause a denial of service (exit) by aborting a con…EPSS 3.9%31 Jul 2013 7.6CVE-2015-5343Apache subversion memory buffer overflow vulnerabilityInteger overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users t…EPSS 30%14 Apr 2016 7.5CVE-2022-24070Apache subversion use after free vulnerabilitySubversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use …EPSS 9.5%12 Apr 2022 7.5CVE-2020-17525Apache subversion null pointer dereference vulnerabilitySubversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a c…EPSS 40%17 Mar 2021

Source: NIST National Vulnerability Database (record CVE-2024-45720), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.