The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protocol request sequences.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0251
Reference (s):
- APPLE:APPLE-SA-2015-09-16-2
- URL: http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html
- BID:74259
- URL: http://www.securityfocus.com/bid/74259
- http://subversion.apache.org/security/CVE-2015-0251-advisory.txt