CVE-2011-2201: Medium severity mark stosberg data\ vulnerability
It was found that perl-Data-FormValidator, a HTML form user input validator, used to treat certain invalid fields as valid, when the untaintallconstraints directive was used (default for majority of Data-FormValidator routines). A remote attacker could use this flaw to bypass perl Taint mode protection mechanism via specially-crafted input provided to the HTML form.
References: [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629511 [2] https://rt.cpan.org/Public/Bug/Display.html?id=61792
Other sources
The Data::FormValidator module 4.66 and earlier for Perl, when untaintallconstraints is enabled, does not properly preserve the taint attribute of data, which might allow remote attackers to bypass the taint protection mechanism via form input.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2201?
CVE-2011-2201 is considered a moderate severity vulnerability due to its potential to allow attackers to bypass input validation.
How do I fix CVE-2011-2201?
To fix CVE-2011-2201, update to a patched version of perl-Data-FormValidator that addresses this vulnerability.
Which versions of perl-Data-FormValidator are affected by CVE-2011-2201?
CVE-2011-2201 affects all versions of perl-Data-FormValidator up to and including version 4.66.
Can CVE-2011-2201 be exploited remotely?
Yes, CVE-2011-2201 can be exploited remotely by an attacker to bypass input validation.
What type of vulnerability is CVE-2011-2201?
CVE-2011-2201 is an input validation flaw that occurs when certain invalid fields are treated as valid.