CVE-2011-2201

The Data::FormValidator module 4.66 and earlier for Perl, when untaint_all_constraints is enabled, does not properly preserve the taint attribute of data, which might allow remote attackers to bypass the taint protection mechanism via form input.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS

6.90% chance of exploitation in the next 30 days, 94th percentile

Published

2011-09-14

Updated

2024-08-06

Proof-of-concept exploits (1)

• https://bugzilla.redhat.com/show_bug.cgi?id=712694

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/35836

References

• CVE Record
• NVD entry

Related

• CVE-2011-2195
• CVE-2011-2202
• CVE-2011-2194
• CVE-2011-2207
• CVE-2011-2189
• CVE-2011-2217