On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables (e.g., svn.exe, etc.) may lead to unexpected command line argument interpretation, including argument injection and execution of other programs, if a specially crafted command line argument string is processed.
All versions of Subversion up to and including Subversion 1.14.3 are affected on Windows platforms only. Users are recommended to upgrade to version Subversion 1.14.4, which fixes this issue.
Subversion is not affected on UNIX-like platforms.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2024/10/08/3 | Mailing List |
| https://subversion.apache.org/security/CVE-2024-45720-advisory.txt | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
11 Feb 2025, 17:22
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| References | () https://subversion.apache.org/security/CVE-2024-45720-advisory.txt - Vendor Advisory | |
| CWE | ||
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| First Time |
Microsoft
Apache subversion Apache Microsoft windows |
|
| CPE | cpe:2.3:a:apache:subversion:*:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* |
09 Oct 2024, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-10-09 13:15
Updated : 2025-02-11 17:22
NVD link : CVE-2024-45720
Mitre link : CVE-2024-45720
JSON object : View
Products Affected
apache
- subversion
microsoft
- windows
CWE
No CWE.