CVE-2011-10043: Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded
Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded.
Module names starting with "::" could be passed to the load function to specify arbitrary module paths.
Attackers able to influence module names passed to load could use that bug to execute arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Module::Loadto a version that resolves this vulnerability.Fixed in 0.22
Event History
Frequently Asked Questions
What is the severity of CVE-2011-10043?
CVE-2011-10043 has a critical severity score of 9.8.
How do I fix CVE-2011-10043?
To fix CVE-2011-10043, upgrade Module::Load to version 0.22 or higher.
What software is affected by CVE-2011-10043?
CVE-2011-10043 affects versions of the Perl Module::Load prior to 0.22.
What type of vulnerability is CVE-2011-10043?
CVE-2011-10043 is a vulnerability that allows arbitrary modules outside of @INC to be loaded.
What potential impact does CVE-2011-10043 have?
CVE-2011-10043 could lead to arbitrary code execution if exploited by an attacker.