// For flags

CVE-2023-31484

perl: CPAN.pm does not verify TLS certificates when downloading distributions over HTTPS

Severity Score

8.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.

A flaw was found in Perl's CPAN, which doesn't check TLS certificates when downloading content. This happens due to `verify_SSL` missing when suing the `HTTP::Tiny` library during the connection. This may allow an attacker to inject into the network path and perform a Man-In-The-Middle attack, causing confidentiality or integrity issues.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2023-04-28 CVE Reserved
  • 2023-04-28 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-08-02 First Exploit
  • 2024-11-18 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-295: Improper Certificate Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cpanpm Project
Search vendor "Cpanpm Project"
 Cpanpm
Search vendor "Cpanpm Project" for product "Cpanpm"
 < 2.35
Search vendor "Cpanpm Project" for product "Cpanpm" and version " < 2.35"
-
Affected
Perl
Search vendor "Perl"
 Perl
Search vendor "Perl" for product "Perl"
 < 5.38.0
Search vendor "Perl" for product "Perl" and version " < 5.38.0"
-
Affected