CVE-2013-1896

mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote…

4.3MediumCVSS base score
29.5%Exploitation in 30 daysEPSS · top 1.8% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.

Timeline

2013
19 Feb 2013
19 Feb 2013
ID reserved
By redhat
10 Jul 20135 months later
10 Jul 2013· 5 months later
Published
2024
6 Aug 202411 years later
6 Aug 2024· 11 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2013-1896, by who scored it
Scored by	CVSS	Score	Vector
NVDNVD · Modified	2.0	Medium4.3	AV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS (exploitation in 30 days): 29.5% · top 1.8% of all CVEs (11 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Affected products

n/a
- affected n/a

References39

http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?view=log (opens in a new tab)x_refsource_CONFIRMx_transferred
http://www-01.ibm.com/support/docview.wss?uid=swg21644047 (opens in a new tab)x_refsource_CONFIRMx_transferred
SSRT101288 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
RHSA-2013:1209 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
oval:org.mitre.oval:def:18835 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?r1=1482522&r2=1485668&diff_format=h (opens in a new tab)x_refsource_CONFIRMx_transferred
openSUSE-SU-2013:1340 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
oval:org.mitre.oval:def:19747 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
http://support.apple.com/kb/HT6150 (opens in a new tab)x_refsource_CONFIRMx_transferred
RHSA-2013:1156 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
USN-1903-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
RHSA-2013:1207 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
61129 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
http://www.apache.org/dist/httpd/Announcement2.2.html (opens in a new tab)x_refsource_CONFIRMx_transferred
RHSA-2013:1208 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
20130822 Apache HTTP Server MERGE Request Denial of Service Vulnerability (opens in a new tab)vendor-advisoryx_refsource_CISCOx_transferred
https://httpd.apache.org/security/vulnerabilities_24.html (opens in a new tab)x_refsource_CONFIRMx_transferred
openSUSE-SU-2013:1341 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
55032 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
openSUSE-SU-2013:1337 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1073139 [8/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1888194 [8/13] - /httpd/site/trunk/content/security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1073149 [9/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2013-1896](https://cveledger.app/badge/CVE-2013-1896.svg)](https://cveledger.app/cve/CVE-2013-1896)

Record last updated 6 Aug 2024, 15:20 UTC.