Lucene search

[email protected]CVE-2012-6141

HistoryJun 04, 2014 - 11:55 p.m.

CVE-2012-6141

2014-06-0423:55:03

CWE-94

[email protected]

web.nvd.nist.gov

cve-2012-6141

app::context

perl

remote code execution

crafted request

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.9 High

AI Score

Confidence

Low

0.018 Low

EPSS

Percentile

88.2%

JSON

The App::Context module 0.01 through 0.968 for Perl does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via a crafted request to (1) App::Session::Cookie or (2) App::Session::HTMLHidden, which is not properly handled when it is deserialized.

Affected configurations

NVD

Node

stephen_adkinsapp\Match\context0.01

stephen_adkinsapp\Match\context0.93

stephen_adkinsapp\Match\context0.95

stephen_adkinsapp\Match\context0.96

stephen_adkinsapp\Match\context0.961

stephen_adkinsapp\Match\context0.962

stephen_adkinsapp\Match\context0.963

stephen_adkinsapp\Match\context0.964

stephen_adkinsapp\Match\context0.965

stephen_adkinsapp\Match\context0.966

stephen_adkinsapp\Match\context0.967

stephen_adkinsapp\Match\context0.968

stephen_adkinsapp\Match\context0.9661

CPENameOperatorVersion
stephen_adkins:app\:\:contextstephen adkins app::contexteq0.01
stephen_adkins:app\:\:contextstephen adkins app::contexteq0.93
stephen_adkins:app\:\:contextstephen adkins app::contexteq0.95
stephen_adkins:app\:\:contextstephen adkins app::contexteq0.96
stephen_adkins:app\:\:contextstephen adkins app::contexteq0.961
stephen_adkins:app\:\:contextstephen adkins app::contexteq0.962
stephen_adkins:app\:\:contextstephen adkins app::contexteq0.963
stephen_adkins:app\:\:contextstephen adkins app::contexteq0.964
stephen_adkins:app\:\:contextstephen adkins app::contexteq0.965
stephen_adkins:app\:\:contextstephen adkins app::contexteq0.966

CPE	Name	Operator	Version
stephen_adkins:app\:\:context	stephen adkins app::context	eq	0.01
stephen_adkins:app\:\:context	stephen adkins app::context	eq	0.93
stephen_adkins:app\:\:context	stephen adkins app::context	eq	0.95
stephen_adkins:app\:\:context	stephen adkins app::context	eq	0.96
stephen_adkins:app\:\:context	stephen adkins app::context	eq	0.961
stephen_adkins:app\:\:context	stephen adkins app::context	eq	0.962
stephen_adkins:app\:\:context	stephen adkins app::context	eq	0.963
stephen_adkins:app\:\:context	stephen adkins app::context	eq	0.964
stephen_adkins:app\:\:context	stephen adkins app::context	eq	0.965
stephen_adkins:app\:\:context	stephen adkins app::context	eq	0.966

Rows per page:

1-10 of 131

References

seclists.org/oss-sec/2013/q2/318

exchange.xforce.ibmcloud.com/vulnerabilities/84198

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.9 High

AI Score

Confidence

Low

0.018 Low

EPSS

Percentile

88.2%

JSON

Related for CVE-2012-6141

cvelist1 nvd1 prion1