Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

USVN (aka User-friendly SVN) before 1.0.9 allows remote code execution via shell metacharacters in the number_start or number_end parameter to LastHundredRequest (aka lasthundredrequestAction) in t...

CVE-2020-17363 · published 5 years ago
Summary

USVN (aka User-friendly SVN) before 1.0.9 allows remote code execution via shell metacharacters in the number_start or number_end parameter to LastHundredRequest (aka lasthundredrequestAction) in the Timeline module. NOTE: this may overlap CVE-2020-25069.

What to do
  • Update usvn usvn to version 1.0.9 or later.
Affected software
VendorProductAffected versions
usvn usvn < 1.0.9
cpe:2.3:a:usvn:usvn:*:*:*:*:*:*:*:*
Original advisory text
USVN (aka User-friendly SVN) before 1.0.9 allows remote code execution via shell metacharacters in the number_start or number_end parameter to LastHundredRequest (aka lasthundredrequestAction) in t...
USVN (aka User-friendly SVN) before 1.0.9 allows remote code execution via shell metacharacters in the number_start or number_end parameter to LastHundredRequest (aka lasthundredrequestAction) in the Timeline module. NOTE: this may overlap CVE-2020-25069.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.9 Critical
Exploitation
5% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published31 Dec 2020
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2020-17363 · NVD
Track software like this
Free during beta