Apache Subversion up to 1.9.10/1.10.4/1.12.0 svnserve Server Process Request Disruption input validation

Summaryinfo

A vulnerability marked as problematic has been reported in Apache Subversion up to 1.9.10/1.10.4/1.12.0. This vulnerability affects unknown code of the component svnserve Server Process. This manipulation as part of Request causes input validation (Disruption). This vulnerability is handled as CVE-2018-11782. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability has been found in Apache Subversion up to 1.9.10/1.10.4/1.12.0 (Versioning Software) and classified as problematic. Affected by this vulnerability is an unknown code of the component svnserve Server Process. The manipulation as part of a Request leads to a input validation vulnerability (Disruption). The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect availability. The summary by CVE is:

In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only request produces a particular answer. This can lead to disruption for users of the server.

The weakness was released 09/26/2019. This vulnerability is known as CVE-2018-11782 since 06/05/2018. The exploitation appears to be easy. The attack can be launched remotely. A single authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 11/23/2025).

The vulnerability scanner Nessus provides a plugin with the ID 276362 (TencentOS Server 3: subversion (TSSA-2022:0260)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (276362). Entry connected to this vulnerability is available at VDB-142322. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Versioning Software

Vendor

• Apache

Name

• Subversion

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.9.0
• 1.9.1
• 1.9.2
• 1.9.3
• 1.9.4
• 1.9.5
• 1.9.6
• 1.9.7
• 1.9.8
• 1.9.9
• 1.9.10
• 1.10
• 1.10.0
• 1.10.1
• 1.10.2
• 1.10.3
• 1.10.4
• 1.11
• 1.12.0

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion