apache/mod_perl: The latest CVE Vulnerabilities and Exploits for Penetration Test

 

Page content

apache/mod_perl Vulnerability Summary

  • Vendor name: apache
  • Product name: mod_perl
  • Total vulnerabilities: 3 (as 2023-05-04)

apache/mod_perl Vulnerability List

CVE-2011-2767: mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a…

Published: 2018-08-26T16:29:00 Last Modified: 2019-09-24T18:15:00

Summary

mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator’s control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.

Common Weakness Enumeration (CWE): CWE-94: Improper Control of Generation of Code (‘Code Injection’)

CWE Description: The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Scores

  • Impact Score: 10.0
  • Exploitability Score: 10.0
  • CVSS: 10.0
  • CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Impact

  • Availability: COMPLETE
  • Confidentiality: COMPLETE
  • Integrity: COMPLETE

Access

  • Authentication: NONE
  • Complexity: LOW
  • Vector: NETWORK

Currently, there is no code for exploiting the CVE-2011-2767 vulnerability.

References

See also: All popular products CVE Vulnerabilities of apache

CVE-2009-0796: Cross-site scripting (XSS) vulnerability in Status.pm in Apache::Status and Apache2::Status in…

Published: 2009-04-07T23:30:00 Last Modified: 2018-10-10T19:31:00

Summary

Cross-site scripting (XSS) vulnerability in Status.pm in Apache::Status and Apache2::Status in mod_perl1 and mod_perl2 for the Apache HTTP Server, when /perl-status is accessible, allows remote attackers to inject arbitrary web script or HTML via the URI.

Common Weakness Enumeration (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)

CWE Description: The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Scores

  • Impact Score: 2.9
  • Exploitability Score: 4.9
  • CVSS: 2.6
  • CVSS Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N

Impact

  • Availability: NONE
  • Confidentiality: NONE
  • Integrity: PARTIAL

Access

  • Authentication: NONE
  • Complexity: HIGH
  • Vector: NETWORK

Exploits Database (Total Exploits Count: 1)

Code designed for conducting penetration testing on CVE-2009-0796 vulnerability.

References

See also: All popular products CVE Vulnerabilities of apache

CVE-2007-1349: PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not…

Published: 2007-03-30T00:19:00 Last Modified: 2022-02-03T16:26:00

Summary

PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.

Common Weakness Enumeration (CWE): CWE-20: Improper Input Validation

CWE Description: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Scores

  • Impact Score: 2.9
  • Exploitability Score: 10.0
  • CVSS: 5.0
  • CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Impact

  • Availability: PARTIAL
  • Confidentiality: NONE
  • Integrity: NONE

Access

  • Authentication: NONE
  • Complexity: LOW
  • Vector: NETWORK

Currently, there is no code for exploiting the CVE-2007-1349 vulnerability.

References

See also: All popular products CVE Vulnerabilities of apache