CVE-2011-1921: Apache Subversion

Medium severity, CVSS 4.3. EPSS: 6% chance of exploitation in the next 30 days.

The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is disabled, does not properly enforce permissions for files that had been publicly readable in the past, which allows remote attackers to obtain sensitive information via a replay REPORT operation.

Affected products

• Apache Subversion: version 1.5.0 only; version 1.5.1 only; version 1.5.2 only; version 1.5.3 only; version 1.5.4 only; version 1.5.5 only; …

Published 2011-06-06. Last modified 2026-06-16.