CVE-2011-2767
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (8.95%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 8.95% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- apache/mod perl · debian/debian linux · redhat/enterprise linux · redhat/enterprise linux desktop · redhat/enterprise linux server · redhat/enterprise linux workstation · canonical/ubuntu linux
- Source
- security@debian.org
References
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00063.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00065.html
- http://www.securityfocus.com/bid/105195Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2737Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2825Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2826Third Party Advisory
- https://bugs.debian.org/644169Issue Tracking, Mailing List, Third Party Advisory
- https://lists.apache.org/thread.html/c8ebe8aad147a3ad2e7b0e8b2da45263171ab5d0fc7f8c100feaa94d%40%3Cmodperl-cvs.perl.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2018/09/msg00018.htmlMailing List, Third Party Advisory
- https://mail-archives.apache.org/mod_mbox/perl-modperl/201110.mbox/raw/%3C20111004084343.GA21290%40ktnx.net%3EMailing List, Third Party Advisory
- https://usn.ubuntu.com/3825-1/Third Party Advisory
- https://usn.ubuntu.com/3825-2/Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00063.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00065.html
- http://www.securityfocus.com/bid/105195Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2737Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2825Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2826Third Party Advisory
- https://bugs.debian.org/644169Issue Tracking, Mailing List, Third Party Advisory
- https://lists.apache.org/thread.html/c8ebe8aad147a3ad2e7b0e8b2da45263171ab5d0fc7f8c100feaa94d%40%3Cmodperl-cvs.perl.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2018/09/msg00018.htmlMailing List, Third Party Advisory
- https://mail-archives.apache.org/mod_mbox/perl-modperl/201110.mbox/raw/%3C20111004084343.GA21290%40ktnx.net%3EMailing List, Third Party Advisory
- https://usn.ubuntu.com/3825-1/Third Party Advisory
- https://usn.ubuntu.com/3825-2/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.