Lucene search
HistorySep 14, 2011 - 4:05 p.m.
CVE-2011-2201
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
AI Score
6.6
Confidence
Low
EPSS
0.02
Percentile
89.0%
The Data::FormValidator module 4.66 and earlier for Perl, when untaint_all_constraints is enabled, does not properly preserve the taint attribute of data, which might allow remote attackers to bypass the taint protection mechanism via form input.
Affected configurations
Node
mark_stosbergdata\Match\formvalidator
ORmark_stosbergdata\Match\formvalidator1.3
ORmark_stosbergdata\Match\formvalidator1.4
ORmark_stosbergdata\Match\formvalidator1.5
ORmark_stosbergdata\Match\formvalidator1.5.1
ORmark_stosbergdata\Match\formvalidator1.6
ORmark_stosbergdata\Match\formvalidator1.7
ORmark_stosbergdata\Match\formvalidator1.8
ORmark_stosbergdata\Match\formvalidator1.9
ORmark_stosbergdata\Match\formvalidator1.10
ORmark_stosbergdata\Match\formvalidator1.11
ORmark_stosbergdata\Match\formvalidator1.91
ORmark_stosbergdata\Match\formvalidator1.92
ORmark_stosbergdata\Match\formvalidator1.93
ORmark_stosbergdata\Match\formvalidator2.00
ORmark_stosbergdata\Match\formvalidator2.01
ORmark_stosbergdata\Match\formvalidator2.02
ORmark_stosbergdata\Match\formvalidator2.03
ORmark_stosbergdata\Match\formvalidator2.04
ORmark_stosbergdata\Match\formvalidator2.10
ORmark_stosbergdata\Match\formvalidator2.11_01
ORmark_stosbergdata\Match\formvalidator2.11_02
ORmark_stosbergdata\Match\formvalidator2.11_03
ORmark_stosbergdata\Match\formvalidator2.11_04
ORmark_stosbergdata\Match\formvalidator3.00
ORmark_stosbergdata\Match\formvalidator3.01
ORmark_stosbergdata\Match\formvalidator3.10
ORmark_stosbergdata\Match\formvalidator3.11
ORmark_stosbergdata\Match\formvalidator3.12
ORmark_stosbergdata\Match\formvalidator3.13
ORmark_stosbergdata\Match\formvalidator3.14
ORmark_stosbergdata\Match\formvalidator3.15
ORmark_stosbergdata\Match\formvalidator3.49_1
ORmark_stosbergdata\Match\formvalidator3.50
ORmark_stosbergdata\Match\formvalidator3.51
ORmark_stosbergdata\Match\formvalidator3.52
ORmark_stosbergdata\Match\formvalidator3.53
ORmark_stosbergdata\Match\formvalidator3.54
ORmark_stosbergdata\Match\formvalidator3.55
ORmark_stosbergdata\Match\formvalidator3.56
ORmark_stosbergdata\Match\formvalidator3.57
ORmark_stosbergdata\Match\formvalidator3.58
ORmark_stosbergdata\Match\formvalidator3.59
ORmark_stosbergdata\Match\formvalidator3.60
ORmark_stosbergdata\Match\formvalidator3.61
ORmark_stosbergdata\Match\formvalidator3.62
ORmark_stosbergdata\Match\formvalidator3.63
ORmark_stosbergdata\Match\formvalidator4.00
ORmark_stosbergdata\Match\formvalidator4.01
ORmark_stosbergdata\Match\formvalidator4.02
ORmark_stosbergdata\Match\formvalidator4.10
ORmark_stosbergdata\Match\formvalidator4.11
ORmark_stosbergdata\Match\formvalidator4.12
ORmark_stosbergdata\Match\formvalidator4.13
ORmark_stosbergdata\Match\formvalidator4.14
ORmark_stosbergdata\Match\formvalidator4.20
ORmark_stosbergdata\Match\formvalidator4.30
ORmark_stosbergdata\Match\formvalidator4.40
ORmark_stosbergdata\Match\formvalidator4.49_01
ORmark_stosbergdata\Match\formvalidator4.50
ORmark_stosbergdata\Match\formvalidator4.51
ORmark_stosbergdata\Match\formvalidator4.52
ORmark_stosbergdata\Match\formvalidator4.53
ORmark_stosbergdata\Match\formvalidator4.54
ORmark_stosbergdata\Match\formvalidator4.55
ORmark_stosbergdata\Match\formvalidator4.56
ORmark_stosbergdata\Match\formvalidator4.57
ORmark_stosbergdata\Match\formvalidator4.60
ORmark_stosbergdata\Match\formvalidator4.61
ORmark_stosbergdata\Match\formvalidator4.62
ORmark_stosbergdata\Match\formvalidator4.63
ORmark_stosbergdata\Match\formvalidator4.65
perlperl
| Vendor | Product | Version | CPE |
|---|---|---|---|
| mark_stosberg | data\ | cpe:2.3:a:mark_stosberg:data\:\:formvalidator:*:*:*:*:*:*:*:* | |
| mark_stosberg | data\ | cpe:2.3:a:mark_stosberg:data\:\:formvalidator:1.3:*:*:*:*:*:*:* | |
| mark_stosberg | data\ | cpe:2.3:a:mark_stosberg:data\:\:formvalidator:1.4:*:*:*:*:*:*:* | |
| mark_stosberg | data\ | cpe:2.3:a:mark_stosberg:data\:\:formvalidator:1.5:*:*:*:*:*:*:* | |
| mark_stosberg | data\ | cpe:2.3:a:mark_stosberg:data\:\:formvalidator:1.5.1:*:*:*:*:*:*:* | |
| mark_stosberg | data\ | cpe:2.3:a:mark_stosberg:data\:\:formvalidator:1.6:*:*:*:*:*:*:* | |
| mark_stosberg | data\ | cpe:2.3:a:mark_stosberg:data\:\:formvalidator:1.7:*:*:*:*:*:*:* | |
| mark_stosberg | data\ | cpe:2.3:a:mark_stosberg:data\:\:formvalidator:1.8:*:*:*:*:*:*:* | |
| mark_stosberg | data\ | cpe:2.3:a:mark_stosberg:data\:\:formvalidator:1.9:*:*:*:*:*:*:* | |
| mark_stosberg | data\ | cpe:2.3:a:mark_stosberg:data\:\:formvalidator:1.10:*:*:*:*:*:*:* |
References
bugs.debian.org/cgi-bin/bugreport.cgi?bug=629511
lists.fedoraproject.org/pipermail/package-announce/2011-September/065416.html
www.openwall.com/lists/oss-security/2011/06/12/3
www.openwall.com/lists/oss-security/2011/06/13/13
www.openwall.com/lists/oss-security/2011/06/13/5
www.securityfocus.com/bid/48167
bugzilla.redhat.com/show_bug.cgi?id=712694
rt.cpan.org/Public/Bug/Display.html?id=61792
Related
openvas
openvas
Fedora Update for perl-Data-FormValidator FEDORA-2011-11680
2012-04-02 00:00:00
Fedora Update for perl-Data-FormValidator FEDORA-2011-11805
2011-09-12 00:00:00
Fedora Update for perl-Data-FormValidator FEDORA-2011-11756
2011-09-12 00:00:00
nessus
nessus
Fedora 16 : perl-Data-FormValidator-4.66-6.fc16 (2011-11680)
2011-09-07 00:00:00
Fedora 15 : perl-Data-FormValidator-4.66-6.fc15 (2011-11756)
2011-09-09 00:00:00
Fedora 14 : perl-Data-FormValidator-4.66-6.fc14 (2011-11805)
2011-09-09 00:00:00
fedora
fedora
[SECURITY] Fedora 16 Update: perl-Data-FormValidator-4.66-6.fc16
2011-09-07 03:41:30
[SECURITY] Fedora 15 Update: perl-Data-FormValidator-4.66-6.fc15
2011-09-08 06:59:58
[SECURITY] Fedora 14 Update: perl-Data-FormValidator-4.66-6.fc14
2011-09-08 07:00:31
cvelist
cvelist
CVE-2011-2201
2011-09-14 15:00:00
cve
cve
CVE-2011-2201
2011-09-14 16:05:23
prion
prion
Input validation
2011-09-14 16:05:00
exploitdb
exploitdb
Perl Data::FormValidator 4.66 Module - 'results()' Security Bypass
2011-06-08 00:00:00
ubuntucve
ubuntucve
CVE-2011-2201
2011-09-14 00:00:00
debiancve
debiancve
CVE-2011-2201
2011-09-14 16:05:23
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
AI Score
6.6
Confidence
Low
EPSS
0.02
Percentile
89.0%
Related for NVD:CVE-2011-2201