CVE-2015-0251: Apache Subversion

Medium severity, CVSS 4.0. EPSS: 7.9% chance of exploitation in the next 30 days.

The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protocol request sequences.

Affected products

• Apache Subversion: version 1.5.0 only; version 1.5.1 only; version 1.5.2 only; version 1.5.3 only; version 1.5.4 only; version 1.5.5 only; …
• Apple Xcode: version 7.0 only
• Opensuse Opensuse: version 13.1 only; version 13.2 only
• Oracle Solaris: version 11.3 only
• Red Hat Enterprise Linux Desktop: version 6.0 only
• Red Hat Enterprise Linux Hpc Node: version 6.0 only
• Red Hat Enterprise Linux Server: version 6.0 only
• Red Hat Enterprise Linux Server Eus: version 6.7.z only
• Red Hat Enterprise Linux Workstation: version 6.0 only

Published 2015-04-08. Last modified 2026-06-17.