CVE-2013-4407

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2013-4407
HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=721634
http://www.debian.org/security/2013/dsa-2801
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00018.html
https://metacpan.org/release/GETTY/HTTP-Body-1.23/
https://www.openwall.com/lists/oss-security/2024/04/07/1
http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits/HTTP-Body.git%3Ba=commit%3Bh=13ac5b23c083bc56e32dd706ca02fca292bd2161
http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits/HTTP-Body.git%3Ba=commit%3Bh=cc75c886256f187cda388641931e8dafad6c2346
http://www.openwall.com/lists/oss-security/2024/04/07/1
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:http-body_project:http-body:1.05:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:1.01:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:0.2:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:0.9:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:*:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:0.8:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:0.5:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:1.12:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:1.04:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:1.10:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:1.02:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:0.4:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:1.08:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:0.6:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:0.03:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:1.14:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:1.07:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:1.15:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:1.00:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:0.7:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:1.09:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:1.11:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:1.06:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:0.01:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:1.03:*:*:*:*:*:*:*
cpe:2.3:a:http-body_project:http-body:1.16:*:*:*:*:*:*:*
History

01 May 2024, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/04/07/1 -

12 Apr 2024, 16:15

Type Values Removed Values Added
References
  • {'url': 'http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits/HTTP-Body.git;a=commit;h=13ac5b23c083bc56e32dd706ca02fca292bd2161', 'name': 'http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits/HTTP-Body.git;a=commit;h=13ac5b23c083bc56e32dd706ca02fca292bd2161', 'tags': [], 'refsource': ''}
  • {'url': 'http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits/HTTP-Body.git;a=commit;h=cc75c886256f187cda388641931e8dafad6c2346', 'name': 'http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits/HTTP-Body.git;a=commit;h=cc75c886256f187cda388641931e8dafad6c2346', 'tags': [], 'refsource': ''}
  • () http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits/HTTP-Body.git%3Ba=commit%3Bh=cc75c886256f187cda388641931e8dafad6c2346 -
  • () https://www.openwall.com/lists/oss-security/2024/04/07/1 -
  • () http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits/HTTP-Body.git%3Ba=commit%3Bh=13ac5b23c083bc56e32dd706ca02fca292bd2161 -
Summary HTTP::Body::Multipart in the HTTP-Body 1.08, 1.17, and earlier module for Perl uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed. HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.

01 Apr 2024, 00:15

Type Values Removed Values Added
References
  • () http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits/HTTP-Body.git;a=commit;h=13ac5b23c083bc56e32dd706ca02fca292bd2161 -
  • () https://metacpan.org/release/GETTY/HTTP-Body-1.23/ -
  • () http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits/HTTP-Body.git;a=commit;h=cc75c886256f187cda388641931e8dafad6c2346 -
Information

Published : 2013-11-23 18:55

Updated : 2024-05-01 18:15

NVD link : CVE-2013-4407

Mitre link : CVE-2013-4407

JSON object : View

Products Affected

http-body_project

  • http-body
CWE
NVD-CWE-noinfo