Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2016-2511: WebSVN lets attackers run malicious scripts

CVE-2016-2511 · published 10 years ago

Summary

Version 2.3.3 and earlier of WebSVN (including the Debian package) lets a remote user insert their own JavaScript or HTML into the log.php page by tampering with the path parameter. This could let the attacker steal session information or perform actions on behalf of a logged‑in user. Upgrade WebSVN to a newer release or apply the vendor’s patch that properly sanitises the path input.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
debian	debian_linux	7.0 8.0 `cpe:2.3:o:debian:debian_linux:7.0:::::::*`
websvn	websvn	<= 2.3.3 `cpe:2.3:a:websvn:websvn::::::::`

Original advisory text

Cross-site scripting (XSS) vulnerability in WebSVN 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the path parameter to log.php.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.1 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published7 Apr 2016

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2016-2511 · NVD

Track software like this

Free during beta