CVE-2011-1487

medium · 5

The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.

CVSS

10.6%

EPSS (exploit prob.)

96th

EPSS percentile

2011-04-11

Published

AV:N/AC:L/Au:N/C:N/I:P/A:N

Weaknesses

CWE-264

Affected products

Vendor	Product	Affected versions
perl	perl	5.10.0
perl	perl	5.10.0
perl	perl	5.10.0
perl	perl	5.10.1
perl	perl	5.10.1
perl	perl	5.10.1
perl	perl	5.13.0
perl	perl	5.13.1
perl	perl	5.13.2
perl	perl	5.13.3
perl	perl	5.13.4
perl	perl	5.13.5
perl	perl	5.13.6
perl	perl	5.13.7
perl	perl	5.13.8
perl	perl	5.13.9
perl	perl	5.13.10
perl	perl	5.13.11
perl	perl	5.11.0
perl	perl	5.11.1
perl	perl	5.11.2
perl	perl	5.11.3
perl	perl	5.11.4
perl	perl	5.11.5
perl	perl	5.12.0
perl	perl	5.12.0
perl	perl	5.12.0
perl	perl	5.12.0
perl	perl	5.12.0
perl	perl	5.12.0
perl	perl	5.12.0
perl	perl	5.12.1
perl	perl	5.12.1
perl	perl	5.12.1
perl	perl	5.12.2
perl	perl	5.12.2
perl	perl	5.12.3
perl	perl	5.12.3
perl	perl	5.12.3
perl	perl	5.12.3

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2011-1487