Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2010-1168

The Safe (aka Safe.pm) module before 2.25 for Perl allows context-dependent attackers to bypass intended (1) Safe::reval and (2) Safe::rdo access restrictions, and inject and execute arbitrary code, via vectors involving implicitly called methods and implicitly blessed objects, as demonstrated by the (a) DESTROY and (b) AUTOLOAD methods, related to "automagic methods."

Published

2010-06-21T16:30:01.133

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-264
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application rafael_garcia-suarez safe 2.08 Yes
Application rafael_garcia-suarez safe 2.09 Yes
Application rafael_garcia-suarez safe 2.11 Yes
Application rafael_garcia-suarez safe 2.13 Yes
Application rafael_garcia-suarez safe 2.14 Yes
Application rafael_garcia-suarez safe 2.15 Yes
Application rafael_garcia-suarez safe 2.16 Yes
Application rafael_garcia-suarez safe 2.17 Yes
Application rafael_garcia-suarez safe 2.18 Yes
Application rafael_garcia-suarez safe 2.19 Yes
Application rafael_garcia-suarez safe 2.20 Yes
Application rafael_garcia-suarez safe 2.21 Yes
Application rafael_garcia-suarez safe 2.22 Yes
Application rafael_garcia-suarez safe 2.23 Yes
Application rafael_garcia-suarez safe 2.24 Yes
Application perl perl * No
References