CVE-2015-3184 Missing authorization in n/a
Remote anonymous users can read hidden files in Apache Subversion repositories due to improper access restrictions in mod_authz_svn.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-3184?
CVE-2015-3184 is a medium-severity missing authorization vulnerability in Apple Xcode, published on 12 Aug 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name.
Weakness: CWE-200
Which versions are affected by CVE-2015-3184?
It affects 2 products.
Products include Apache Subversion, Apple Xcode.
How do I fix CVE-2015-3184?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2015-3184 being exploited?
There is no known exploitation of CVE-2015-3184 in the wild and no public exploit code.
Other vulnerabilities in Apple Xcode
- CVE-2017-9800 A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha
- CVE-2013-4246 Denial of service in n/a
- CVE-2015-5259 Integer overflow in n/a
- CVE-2024-45720 Apache Subversion: Command line argument injection on Windows platforms
- CVE-2015-0202 Denial of service in n/a
Sources
Also known as DEBIAN-CVE-2015-3184, GHSA-8578-652m-fxc9, UBUNTU-CVE-2015-3184.