CVE-1999-1437: High severity Ralf S. Engelschall Eperl vulnerability
ePerl 2.2.12 allows remote attackers to read arbitrary files and possibly execute certain commands by specifying a full pathname of the target file as an argument to bar.phtml.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
ePerlfrom your environment.If ePerl is not required, uninstall or remove the ePerl installation to eliminate the vulnerable component.
- Configuration
Remove or disable the bar.phtml endpoint, or modify application input validation so that bar.phtml rejects any argument that is a full pathname (do not accept absolute file paths).
ePerl bar.phtml handling = disabled or reject full-path arguments - Compensating control
Restrict access to the ePerl web application and/or the bar.phtml endpoint using network controls (firewall, web server access rules, or WAF) so only trusted IPs or internal networks can reach it; block requests that include full-pathname arguments.
- Operational
Search web server and application logs for requests to bar.phtml and for attempts to supply full pathnames; if suspicious activity or compromise is detected, investigate and rotate any potentially exposed credentials and restore affected systems from known-good backups.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1437?
CVE-1999-1437 is classified as a critical vulnerability due to its potential for unauthorized access to sensitive files.
How do I fix CVE-1999-1437?
To mitigate CVE-1999-1437, upgrade ePerl to a version later than 2.2.12 where the vulnerability has been patched.
What systems are affected by CVE-1999-1437?
CVE-1999-1437 specifically affects ePerl version 2.2.12.
Can CVE-1999-1437 lead to remote code execution?
Yes, CVE-1999-1437 may allow remote attackers to execute certain commands through file path manipulation.
What impact does CVE-1999-1437 have on file security?
CVE-1999-1437 allows remote attackers to read arbitrary files, compromising the confidentiality of sensitive data.