CVE-2011-2767

Опубликовано: 26 авг. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Низкий

Описание

mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00063.html
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00065.html
http://www.securityfocus.com/bid/105195
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:2737
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2825
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2826
Third Party Advisory
https://bugs.debian.org/644169
Issue Tracking
Mailing List
Third Party Advisory
https://lists.apache.org/thread.html/c8ebe8aad147a3ad2e7b0e8b2da45263171ab5d0fc7f8c100feaa94d%40%3Cmodperl-cvs.perl.apache.org%3E
https://lists.debian.org/debian-lts-announce/2018/09/msg00018.html
Mailing List
Third Party Advisory
https://mail-archives.apache.org/mod_mbox/perl-modperl/201110.mbox/raw/%3C20111004084343.GA21290%40ktnx.net%3E
Mailing List
Third Party Advisory
https://usn.ubuntu.com/3825-1/
Third Party Advisory
https://usn.ubuntu.com/3825-2/
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00063.html
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00065.html
http://www.securityfocus.com/bid/105195
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:2737
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2825
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2826
Third Party Advisory
https://bugs.debian.org/644169
Issue Tracking
Mailing List
Third Party Advisory
https://lists.apache.org/thread.html/c8ebe8aad147a3ad2e7b0e8b2da45263171ab5d0fc7f8c100feaa94d%40%3Cmodperl-cvs.perl.apache.org%3E

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:mod_perl:*:*:*:*:*:*:*:*

Версия от 2.0.0 (включая) до 2.0.10 (включая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:6.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

EPSS

Процентиль: 90%

0.05542

Низкий

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-94

Связанные уязвимости

CVE-2011-2767

CVSS3: 9.8

ubuntu

около 7 лет назад

CVE-2011-2767

CVSS3: 6.3

redhat

около 14 лет назад

CVE-2011-2767

CVSS3: 9.8

debian

около 7 лет назад

mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl ...

openSUSE-SU-2019:2549-1

suse-cvrf

почти 6 лет назад

Security update for apache2-mod_perl

SUSE-SU-2020:14266-1

suse-cvrf

почти 6 лет назад

Security update for apache2-mod_perl

EPSS

Процентиль: 90%

0.05542

Низкий

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-94