CVE-2024-46901
Published: 09 December 2024
Summary
CVE-2024-46901 is a low-severity Improper Input Validation (CWE-20) vulnerability in Apache Subversion. Its CVSS base score is 3.1 (Low).
Operationally, ranked in the top 9.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-46901 is an insufficient input validation flaw (CWE-20, CWE-116) in Apache Subversion that affects filename handling against control characters. It impacts all versions up to and including 1.14.4 when repositories are served through the mod_dav_svn module; repositories accessed by other means are unaffected. An authenticated user with commit rights can introduce a corrupted revision that disrupts subsequent repository operations for all users.
An attacker with existing commit access can exploit the weakness over the network to upload a specially crafted filename containing control characters. Successful exploitation results in a corrupted revision that causes denial-of-service effects for other repository users, though the CVSS score of 3.1 reflects the high attack complexity and limited impact.
Advisories recommend upgrading to Subversion 1.14.5, which contains the fix. The Debian LTS announcement further details backported packages for affected distributions.
The EPSS score rose from a low baseline to a peak of 0.1250 on 2025-12-11 before receding to the current value of 0.0581, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-42181
Vulnerability details
Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository. All versions of Subversion up to and…
more
including Subversion 1.14.4 are affected if serving repositories via mod_dav_svn. Users are recommended to upgrade to version 1.14.5, which fixes this issue. Repositories served via other access methods are not affected.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Security testing and developer training directly verify and enforce proper input validation, reducing exploitability of injection and malformed-data weaknesses.
Security testing and evaluation at multiple SDLC stages directly detects missing or flawed input validation, with the required remediation process ensuring fixes are applied.
Directly implements checks on information inputs to reject invalid data before processing.
Validating that output matches expected content directly mitigates failures to properly encode or escape data for its destination context.
Spam protection mechanisms perform filtering and detection on inbound/outbound messages, directly compensating for missing or weak input validation of unsolicited content.