Vulnerability Description
Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Module names starting with "::" could be passed to the load function to specify arbitrary module paths. Attackers able to influence module names passed to load could use that bug to execute arbitrary code.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-
- https://metacpan.org/release/BINGOS/Module-Load-0.22/changes
- https://metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.2
FAQ
What is CVE-2011-10043?
CVE-2011-10043 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Module names starting with "::" could be passed to the load function to specify arbitrary module paths...
How severe is CVE-2011-10043?
CVE-2011-10043 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2011-10043?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.