CVE-2023-47039Heap-based Buffer Overflow in Perl

Severity
7.8HIGHNVD
EPSS
0.1%
top 76.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 2
Latest updateNov 14

Description

A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find and execute `cmd.exe` within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. This flaw allows an attacker with limited privileges to place`cmd.exe` in locations with

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages1 packages

NVDperl/perl< 5.32.1

Patches

🔴Vulnerability Details

3
CVEList
Perl: perl for windows binary hijacking vulnerability2024-01-02
GHSA
GHSA-44qm-928x-6p3g: A vulnerability was found in Perl2024-01-02
OSV
CVE-2023-47039: A vulnerability was found in Perl2023-11-25

📋Vendor Advisories

3
CISA ICS
Siemens SINEC INS2024-11-14
Red Hat
perl: Perl for Windows binary hijacking vulnerability2023-11-25
Debian
CVE-2023-47039: perl - A vulnerability was found in Perl. This security issue occurs while Perl for Win...2023