What’s Vulnerable › Vulnerabilities

CVE-2014-3528

• Severity: medium (CVSS 4.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-08-19 · updated 2026-06-17
• Weakness: CWE-255

Description

Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.

Affected products

• Apache Software Foundation Apache Subversion: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 (+83)
• Apple Xcode: 6.1.1
• Canonical Ubuntu Linux: 12.04, 14.04
• Opensuse: 12.3, 13.1
• RedHat Enterprise Linux Desktop: 6.0, 7.0
• RedHat Enterprise Linux Hpc Node: 6.0, 7.0
• RedHat Enterprise Linux Server: 6.0, 7.0
• RedHat Enterprise Linux Server Eus: 6.6.z
• RedHat Enterprise Linux Workstation: 6.0, 7.0

References

• http://lists.apple.com/archives/security-announce/2015/Mar/msg00003.html
• http://lists.opensuse.org/opensuse-updates/2014-08/msg00038.html
• http://rhn.redhat.com/errata/RHSA-2015-0165.html
• http://rhn.redhat.com/errata/RHSA-2015-0166.html
• http://secunia.com/advisories/59432
• http://secunia.com/advisories/59584
• http://secunia.com/advisories/60722
• http://subversion.apache.org/security/CVE-2014-3528-advisory.txt
• http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
• http://www.securityfocus.com/bid/68995
• http://www.ubuntu.com/usn/USN-2316-1
• https://security.gentoo.org/glsa/201610-05

Get alerted when CVE-2014-3528 or the next vulnerability affects your stack