CVE-2014-3528

MediumCVSS 4.0/10Last modified Jun 17, 2026

Description

Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.

Metrics

CVSS 2.0 4.0/10AV:N/AC:H/Au:N/C:P/I:P/A:N

Weakness enumeration

CWE-255

Affected software

No affected versions have been published.

Timeline

Published
Aug 19, 2014
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2014

CVE-2014-35294.3The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML externalCVE-2014-35307.5The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application CVE-2014-35315.4Multiple cross-site scripting (XSS) vulnerabilities in Foreman before 1.5.2 allow remote authenticated users to inject arbitrary web script CVE-2014-35322.1dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service CVE-2014-35332.1dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service (disconnect) via a certain sequence of craftCVE-2014-35347.2arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operationsCVE-2014-35357.8include/linux/netdevice.h in the Linux kernel before 2.6.36 incorrectly uses macros for netdev_printk and its related logging implementationCVE-2014-35365.5CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registrationCVE-2014-35371.2The web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cacCVE-2014-35385.0file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial oCVE-2014-35399.8base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call toCVE-2014-35417.5The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 all
CVE-2014-3528: Medium severity, CVSS 4.0 | Vulnix