CVE-2004-0397Exploit(subversion / subversion)

MEDIUMCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch subversion subversion systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.

4.0/ 10 priority

Sources & remediation

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • subversion

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
Products
subversion

3 versions affected across 1 product

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-12: 1PoC Mentioned / Linked · 2026-09-12: 1Exploit Tool / Code · 2026-09-12: 1Patch / Workaround · 2026-09-12: 1Technical Details · 2026-09-12: 109-12
Signal classification1 categories
Exploit
1100.0%
Referenced assets3 URLs
Full discourse1 post
  • bluedragonsec@bluedragonsec
    Exploit

    Ok, I'll share a private exploit that I wrote in 2004 : https://github.com/bluedragonsecurity/exploits/tree/main/cve-2004-0397-priv8-x86freebsd-subversion-remote-bof CVE-2004-0397 - Subversion 1.0.2 remote stack overflow exploit for x86 freebsd 4.10 & 4.8 The original private exploit code was written in 2004 and was patched in 2026. Original code by : Antonius (w1sdom) - http://bluedragonsec.com - http://github.com/bluedragonsecurity compile : gcc -o exploit exploit.c

    Post summary

    The post publishes a private exploit for CVE-2004-0397 on GitHub, detailing compilation steps and author information, and notes that the vulnerability was patched in 2026. It provides direct proof of a working exploit with no evidence of current active exploitation.

    0000059
    56 followersView on X
CPE platform detail3 entries

3 of 3 entries

PartVendorProductVersionTarget SWTarget HW
Appsubversionsubversion1.0--
Appsubversionsubversion1.0.1--
Appsubversionsubversion1.0.2--

Explore more