CVE-2008-5919: Path Traversal
Directory traversal vulnerability in rss.php in WebSVN 2.0 and earlier, when magicquotesgpc is disabled, allows remote attackers to overwrite arbitrary files via directory traversal sequences in the rev parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable magic_quotes_gpc (set magic_quotes_gpc = On in php.ini or via your PHP configuration) to prevent directory traversal via the rev parameter in WebSVN 2.0 and earlier (vulnerable when magic_quotes_gpc is disabled).
PHP magic_quotes_gpc = On
Event History
Frequently Asked Questions
What is the severity of CVE-2008-5919?
CVE-2008-5919 is considered to have a medium severity level due to its ability to allow unauthorized file overwrites.
How do I fix CVE-2008-5919?
To fix CVE-2008-5919, upgrade to a version of WebSVN higher than 2.0 or implement proper input validation to prevent directory traversal.
Which versions of WebSVN are affected by CVE-2008-5919?
CVE-2008-5919 affects WebSVN versions up to and including 2.0, as well as specific earlier versions like 1.00 through 1.62.
What type of vulnerability is CVE-2008-5919?
CVE-2008-5919 is a directory traversal vulnerability that allows remote attackers to overwrite arbitrary files.
Is magic_quotes_gpc relevant to CVE-2008-5919?
Yes, the vulnerability is present when magic_quotes_gpc is disabled, allowing exploitation through crafted input.