CVE-2017-16248 The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathname, which differs from the intended poli...
HighCVSS 7.5
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathname, which differs from the intended policy of allowing access only when the filename itself has a '.' character.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libcatalyst-plugin-static-simple-perl(Debian:12) | < 0.34-1 | 0.34-1 |
| debian/libcatalyst-plugin-static-simple-perl(Debian:13) | < 0.34-1 | 0.34-1 |
| debian/libcatalyst-plugin-static-simple-perl(Debian:14) | < 0.34-1 | 0.34-1 |
| catalyst-plugin-static-simple project catalyst-plugin-static-simple | < 0.34 | 0.34 |
References
- Debian Security Tracker CVE-2017-16248 vendor-advisory
- bugs.debian.org issue-tracking third-party-advisory
- metacpan.org release-notes
- rt.cpan.org issue-tracking third-party-advisory