mod_dav.c in the Apache HTTP Server before 2.2.25 does...
Moderate severity
Unreviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Feb 20, 2023
Description
Published by the National Vulnerability Database
Jul 10, 2013
Published to the GitHub Advisory Database
May 13, 2022
Last updated
Feb 20, 2023
mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.
References