CVE-2013-4505

The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service (resource consumption) via a relative URL in a REPORT request.

• CWE-264

• http://lists.opensuse.org/opensuse-updates/2013-12/msg00029.html
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00048.html
• http://osvdb.org/100364
• http://secunia.com/advisories/55855Vendor Advisory
• http://subversion.apache.org/security/CVE-2013-4505-advisory.txtPatch, Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00029.html
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00048.html
• http://osvdb.org/100364
• http://secunia.com/advisories/55855Vendor Advisory
• http://subversion.apache.org/security/CVE-2013-4505-advisory.txtPatch, Vendor Advisory

Published

Dec 7, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4499Cross-site scripting (XSS) vulnerability in the Bean module …
• CVE-2013-4500The Quiz module 6.x-4.x before 6.x-4.5 for Drupal allows rem…
• CVE-2013-4501The default views in the Quiz module 6.x-4.x before 6.x-4.5 …
• CVE-2013-4502The FileField Sources module 6.x-1.x before 6.x-1.9 and 7.x-…
• CVE-2013-4503Cross-site scripting (XSS) vulnerability in the Feed Element…
• CVE-2013-4504The Monster Menus module 7.x-1.x before 7.x-1.15 allows remo…
• CVE-2013-4506Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-4507Cross-site scripting (XSS) vulnerability in CollectiveAccess…
• CVE-2013-4508lighttpd before 1.4.34, when SNI is enabled, configures weak…7.5
• CVE-2013-4509The default configuration of IBUS 1.5.4, and possibly 1.5.2 …
• CVE-2013-4510Directory traversal vulnerability in the client in Tryton 3.…
• CVE-2013-4511Multiple integer overflows in Alchemy LCD frame-buffer drive…