Description

The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.

Remediation

References

CVE-2011-1487

Related Vulnerabilities

Joomla Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2015-7857)

IBM WebSEAL Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-3018)

Moodle Server-Side Request Forgery (SSRF) Vulnerability (CVE-2018-1042)

WordPress 5.2.x Multiple Vulnerabilities (5.2 - 5.2.5)

WordPress Plugin Easy Digital Downloads-htaccess Editor Cross-Site Scripting (1.0.0)

Severity

Medium

Classification

CVE-2011-1487 CWE-264

Tags

Missing Update Known Vulnerabilities