CVE-2021-28544

Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.

• CWE-200
• CWE-200

• http://seclists.org/fulldisclosure/2022/Jul/18Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZ4ARNGLMGYBKYDX2B7DRBNMF6EH3A6R/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJPMCWCGWBN3QWCDVILWQWPC75RR67LT/Mailing List, Third Party Advisory
• https://subversion.apache.org/security/CVE-2021-28544-advisory.txtExploit, Patch, Vendor Advisory
• https://support.apple.com/kb/HT213345Third Party Advisory
• https://www.debian.org/security/2022/dsa-5119Third Party Advisory
• http://seclists.org/fulldisclosure/2022/Jul/18Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZ4ARNGLMGYBKYDX2B7DRBNMF6EH3A6R/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJPMCWCGWBN3QWCDVILWQWPC75RR67LT/Mailing List, Third Party Advisory
• https://subversion.apache.org/security/CVE-2021-28544-advisory.txtExploit, Patch, Vendor Advisory
• https://support.apple.com/kb/HT213345Third Party Advisory
• https://www.debian.org/security/2022/dsa-5119Third Party Advisory

Published

Apr 12, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-28507An issue has recently been discovered in Arista EOS where, u…7.1
• CVE-2021-28508This advisory documents the impact of an internally found vu…6.1
• CVE-2021-28509This advisory documents the impact of an internally found vu…6.1
• CVE-2021-28510For certain systems running EOS, a Precision Time Protocol (…7.5
• CVE-2021-28511This advisory documents the impact of an internally found vu…6.5
• CVE-2021-28543Varnish varnish-modules before 0.17.1 allows remote attacker…7.5
• CVE-2021-28545Acrobat Reader DC versions versions 2020.013.20074 (and earl…8.1
• CVE-2021-28546Acrobat Reader DC versions versions 2020.013.20074 (and earl…6.5
• CVE-2021-28547Adobe Creative Cloud Desktop Application for macOS version 5…7.8
• CVE-2021-28548Adobe Photoshop versions 21.2.6 (and earlier) and 22.3 (and …7.8
• CVE-2021-28549Adobe Photoshop versions 21.2.6 (and earlier) and 22.3 (and …7.8
• CVE-2021-28550Acrobat Reader DC versions versions 2021.001.20150 (and earl…8.8