Medium severity4.3NVD Advisory· Published Apr 12, 2022· Updated Jun 17, 2026

CVE-2021-28544

Description

Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Apache/Subversion3 versions
cpe:2.3:a:apache:subversion:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:apache:subversion:*:*:*:*:*:*:*:*range: >=1.10.0,<=1.14.1
- (no CPE)
- (no CPE)range: 1.10.0 to 1.14.1
Apple Inc./macOS
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Range: >=12.0,<12.5
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Fedoraproject/Fedora2 versions
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
osv-coords26 versions
pkg:bitnami/subversion pkg:rpm/opensuse/subversion&distro=openSUSE%20Leap%2015.3 pkg:rpm/suse/subversion&distro=SUSE%20Enterprise%20Storage%206 pkg:rpm/suse/subversion&distro=SUSE%20Enterprise%20Storage%207 pkg:rpm/suse/subversion&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOS pkg:rpm/suse/subversion&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS pkg:rpm/suse/subversion&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-ESPOS pkg:rpm/suse/subversion&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSS pkg:rpm/suse/subversion&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOS pkg:rpm/suse/subversion&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSS pkg:rpm/suse/subversion&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3 pkg:rpm/suse/subversion&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP3 pkg:rpm/suse/subversion&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP3 pkg:rpm/suse/subversion&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP2 pkg:rpm/suse/subversion&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCL pkg:rpm/suse/subversion&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS pkg:rpm/suse/subversion&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-BCL pkg:rpm/suse/subversion&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSS pkg:rpm/suse/subversion&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSS pkg:rpm/suse/subversion&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015 pkg:rpm/suse/subversion&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1 pkg:rpm/suse/subversion&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2 pkg:rpm/suse/subversion&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/subversion&distro=SUSE%20Manager%20Proxy%204.1 pkg:rpm/suse/subversion&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.1 pkg:rpm/suse/subversion&distro=SUSE%20Manager%20Server%204.1
>= 1.10.0, < 1.14.2+ 25 more
- (no CPE)range: >= 1.10.0, < 1.14.2
- (no CPE)range: < 1.10.6-150300.10.8.1
- (no CPE)range: < 1.10.6-150000.3.21.1
- (no CPE)range: < 1.10.6-150000.3.21.1
- (no CPE)range: < 1.10.6-150000.3.21.1
- (no CPE)range: < 1.10.6-150000.3.21.1
- (no CPE)range: < 1.10.6-150000.3.21.1
- (no CPE)range: < 1.10.6-150000.3.21.1
- (no CPE)range: < 1.10.6-150000.3.21.1
- (no CPE)range: < 1.10.6-150000.3.21.1
- (no CPE)range: < 1.10.6-150300.10.8.1
- (no CPE)range: < 1.10.6-150300.10.8.1
- (no CPE)range: < 1.10.6-150300.10.8.1
- (no CPE)range: < 1.10.6-150000.3.21.1
- (no CPE)range: < 1.10.6-150000.3.21.1
- (no CPE)range: < 1.10.6-150000.3.21.1
- (no CPE)range: < 1.10.6-150000.3.21.1
- (no CPE)range: < 1.10.6-150000.3.21.1
- (no CPE)range: < 1.10.6-150000.3.21.1
- (no CPE)range: < 1.10.6-150000.3.21.1
- (no CPE)range: < 1.10.6-150000.3.21.1
- (no CPE)range: < 1.10.6-150000.3.21.1
- (no CPE)range: < 1.10.6-3.6.1
- (no CPE)range: < 1.10.6-150000.3.21.1
- (no CPE)range: < 1.10.6-150000.3.21.1
- (no CPE)range: < 1.10.6-150000.3.21.1

Patches

Vulnerability mechanics

References

subversion.apache.org/security/CVE-2021-28544-advisory.txtnvdExploitPatchVendor Advisory
seclists.org/fulldisclosure/2022/Jul/18nvdMailing ListThird Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZ4ARNGLMGYBKYDX2B7DRBNMF6EH3A6R/nvdMailing ListThird Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJPMCWCGWBN3QWCDVILWQWPC75RR67LT/nvdMailing ListThird Party Advisory
support.apple.com/kb/HT213345nvdThird Party Advisory
www.debian.org/security/2022/dsa-5119nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000