Summary
The remote host is missing an update to the system as announced in the referenced advisory.
Solution
Update your system with the appropriate patches or software upgrades.
http://secunia.com/advisories/32338/
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512191 http://www.gulftech.org/?node=research&article_id=00132-10202008 http://www.vuxml.org/freebsd/71597e3e-f6b8-11dd-94d9-0030843d3802.html
Insight
The following package is affected: websvn
CVE-2008-5918
Cross-site scripting (XSS) vulnerability in the
getParameterisedSelfUrl function in index.php in WebSVN 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVE-2008-5919
Directory traversal vulnerability in rss.php in WebSVN 2.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to overwrite arbitrary files via directory traversal sequences in the rev parameter.
CVE-2009-0240
listing.php in WebSVN 2.0 and possibly 1.7 beta, when using an SVN authz file, allows remote authenticated users to read changelogs or diffs for restricted projects via a modified repname parameter.
Severity
Classification
-
CVE CVE-2008-5918, CVE-2008-5919, CVE-2009-0240 -
CVSS Base Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
Related Vulnerabilities