CVE-2011-2201

The Data::FormValidator module 4.66 and earlier for Perl, when untaint_all_constraints is enabled, does not properly preserve the taint attribute of data, which might allow remote attackers to bypass the taint protection mechanism via form input.

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS

6.90% chance of exploitation in the next 30 days, 94th percentile

Published

2011-09-14

Updated

2024-08-06

Proof-of-concept exploits (1)

• https://bugzilla.redhat.com/show_bug.cgi?id=712694

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/35836

Security advisories

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629511
• http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065416.html
• http://www.openwall.com/lists/oss-security/2011/06/12/3
• http://www.openwall.com/lists/oss-security/2011/06/13/13
• http://www.securityfocus.com/bid/48167

References

• CVE Record
• NVD entry