CVE-2017-16248
Severity Score
7.5
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathname, which differs from the intended policy of allowing access only when the filename itself has a '.' character.
El módulo Catalyst-Plugin-Static-Simple en versiones anteriores a la 0.34 para Perl permite que atacantes remotos lean archivos arbitrarios si hay un caracter "." en cualquier parte del nombre de ruta, lo que difiere de la política prevista que solo permite el acceso cuando el nombre de archivo en sí contiene un caracter ".".
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2017-10-31 CVE Reserved
- 2017-11-01 CVE Published
- 2023-05-08 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| https://bugs.debian.org/880458 | Third Party Advisory | |
| https://metacpan.org/changes/distribution/Catalyst-Plugin-Static-Simple | Release Notes | |
| https://rt.cpan.org/Public/Bug/Display.html?id=120558 | Issue Tracking |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Catalyst-plugin-static-simple Project Search vendor "Catalyst-plugin-static-simple Project" | Catalyst-plugin-static-simple Search vendor "Catalyst-plugin-static-simple Project" for product "Catalyst-plugin-static-simple" | < 0.34 Search vendor "Catalyst-plugin-static-simple Project" for product "Catalyst-plugin-static-simple" and version " < 0.34" | perl |
Affected
| ||||||