CVE-2014-1875

2014-10-0623:55:07

CWE-59

[email protected]

web.nvd.nist.gov

cve-2014-1875

capture::tiny

perl

symlink attack

local users

arbitrary files

3.6 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:P/A:P

6.2 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.2%

JSON

The Capture::Tiny module before 0.24 for Perl allows local users to write to arbitrary files via a symlink attack on a temporary file.

Affected configurations

NVD

Node

cspancapture-tinyRange≤0.23

cspancapture-tinyMatch0.20

cspancapture-tinyMatch0.21

cspancapture-tinyMatch0.22

CPENameOperatorVersion
cspan:capture-tinycspan capture-tinyle0.23
cspan:capture-tinycspan capture-tinyeq0.20
cspan:capture-tinycspan capture-tinyeq0.21
cspan:capture-tinycspan capture-tinyeq0.22

CPE	Name	Operator	Version
cspan:capture-tiny	cspan capture-tiny	le	0.23
cspan:capture-tiny	cspan capture-tiny	eq	0.20
cspan:capture-tiny	cspan capture-tiny	eq	0.21
cspan:capture-tiny	cspan capture-tiny	eq	0.22