CVE-2011-2201 The Data::FormValidator module 4.66 and earlier for Perl, when untaint_all_constraints is enabled, does not properly preserve the taint attribute of data, which might allow remote attackers to bypass....
MediumCVSS 4.3
EPSS 6.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Data::FormValidator module 4.66 and earlier for Perl, when untaint_all_constraints is enabled, does not properly preserve the taint attribute of data, which might allow remote attackers to bypass the taint protection mechanism via form input.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libdata-formvalidator-perl(Debian:12) | < 4.66-3 | 4.66-3 |
| debian/libdata-formvalidator-perl(Debian:13) | < 4.66-3 | 4.66-3 |
| debian/libdata-formvalidator-perl(Debian:14) | < 4.66-3 | 4.66-3 |
| mark stosberg dataformvalidator | <= 4.66 | No fix listed |
| mark stosberg dataformvalidator | = 1.3 | No fix listed |
| mark stosberg dataformvalidator | = 1.4 | No fix listed |
| mark stosberg dataformvalidator | = 1.5 | No fix listed |
| mark stosberg dataformvalidator | = 1.5.1 | No fix listed |
| mark stosberg dataformvalidator | = 1.6 | No fix listed |
| mark stosberg dataformvalidator | = 1.7 | No fix listed |
| mark stosberg dataformvalidator | = 1.8 | No fix listed |
| mark stosberg dataformvalidator | = 1.9 | No fix listed |
| mark stosberg dataformvalidator | = 1.10 | No fix listed |
| mark stosberg dataformvalidator | = 1.11 | No fix listed |
| mark stosberg dataformvalidator | = 1.91 | No fix listed |
| mark stosberg dataformvalidator | = 1.92 | No fix listed |
| mark stosberg dataformvalidator | = 1.93 | No fix listed |
| mark stosberg dataformvalidator | = 2.00 | No fix listed |
| mark stosberg dataformvalidator | = 2.01 | No fix listed |
| mark stosberg dataformvalidator | = 2.02 | No fix listed |
| mark stosberg dataformvalidator | = 2.03 | No fix listed |
| mark stosberg dataformvalidator | = 2.04 | No fix listed |
| mark stosberg dataformvalidator | = 2.10 | No fix listed |
| mark stosberg dataformvalidator | = 2.11_01 | No fix listed |
| mark stosberg dataformvalidator | = 2.11_02 | No fix listed |
Show 50 more
| Product | Affected versions | Fixed in |
|---|---|---|
| mark stosberg dataformvalidator | = 2.11_03 | No fix listed |
| mark stosberg dataformvalidator | = 2.11_04 | No fix listed |
| mark stosberg dataformvalidator | = 3.00 | No fix listed |
| mark stosberg dataformvalidator | = 3.01 | No fix listed |
| mark stosberg dataformvalidator | = 3.10 | No fix listed |
| mark stosberg dataformvalidator | = 3.11 | No fix listed |
| mark stosberg dataformvalidator | = 3.12 | No fix listed |
| mark stosberg dataformvalidator | = 3.13 | No fix listed |
| mark stosberg dataformvalidator | = 3.14 | No fix listed |
| mark stosberg dataformvalidator | = 3.15 | No fix listed |
| mark stosberg dataformvalidator | = 3.49_1 | No fix listed |
| mark stosberg dataformvalidator | = 3.50 | No fix listed |
| mark stosberg dataformvalidator | = 3.51 | No fix listed |
| mark stosberg dataformvalidator | = 3.52 | No fix listed |
| mark stosberg dataformvalidator | = 3.53 | No fix listed |
| mark stosberg dataformvalidator | = 3.54 | No fix listed |
| mark stosberg dataformvalidator | = 3.55 | No fix listed |
| mark stosberg dataformvalidator | = 3.56 | No fix listed |
| mark stosberg dataformvalidator | = 3.57 | No fix listed |
| mark stosberg dataformvalidator | = 3.58 | No fix listed |
| mark stosberg dataformvalidator | = 3.59 | No fix listed |
| mark stosberg dataformvalidator | = 3.60 | No fix listed |
| mark stosberg dataformvalidator | = 3.61 | No fix listed |
| mark stosberg dataformvalidator | = 3.62 | No fix listed |
| mark stosberg dataformvalidator | = 3.63 | No fix listed |
| mark stosberg dataformvalidator | = 4.00 | No fix listed |
| mark stosberg dataformvalidator | = 4.01 | No fix listed |
| mark stosberg dataformvalidator | = 4.02 | No fix listed |
| mark stosberg dataformvalidator | = 4.10 | No fix listed |
| mark stosberg dataformvalidator | = 4.11 | No fix listed |
| mark stosberg dataformvalidator | = 4.12 | No fix listed |
| mark stosberg dataformvalidator | = 4.13 | No fix listed |
| mark stosberg dataformvalidator | = 4.14 | No fix listed |
| mark stosberg dataformvalidator | = 4.20 | No fix listed |
| mark stosberg dataformvalidator | = 4.30 | No fix listed |
| mark stosberg dataformvalidator | = 4.40 | No fix listed |
| mark stosberg dataformvalidator | = 4.49_01 | No fix listed |
| mark stosberg dataformvalidator | = 4.50 | No fix listed |
| mark stosberg dataformvalidator | = 4.51 | No fix listed |
| mark stosberg dataformvalidator | = 4.52 | No fix listed |
| mark stosberg dataformvalidator | = 4.53 | No fix listed |
| mark stosberg dataformvalidator | = 4.54 | No fix listed |
| mark stosberg dataformvalidator | = 4.55 | No fix listed |
| mark stosberg dataformvalidator | = 4.56 | No fix listed |
| mark stosberg dataformvalidator | = 4.57 | No fix listed |
| mark stosberg dataformvalidator | = 4.60 | No fix listed |
| mark stosberg dataformvalidator | = 4.61 | No fix listed |
| mark stosberg dataformvalidator | = 4.62 | No fix listed |
| mark stosberg dataformvalidator | = 4.63 | No fix listed |
| mark stosberg dataformvalidator | = 4.65 | No fix listed |
References
- Debian Security Tracker CVE-2011-2201 vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org exploit patch
- FEDORA-2011-11680 exploit patch vendor-advisory
- [oss-security] 20110612 CVE Request -- Data-FormValidator -- Reports invalid field as valid when untaint_all_constraints used exploit mailing-list patch
- [oss-security] 20110613 Re: CVE Request -- Data-FormValidator -- Reports invalid field as valid when untaint_all_constraints used exploit mailing-list patch
- [oss-security] 20110613 Re: CVE Request -- Data-FormValidator -- Reports invalid field as valid when untaint_all_constraints used mailing-list
- 48167 exploit vdb-entry
- bugzilla.redhat.com exploit patch
- rt.cpan.org exploit