CVE-2013-7329: Infoleak
It was reported [1],[2] that the CGI::Application perl module suffered from a flaw where, in certain cases, it would unexpectedly dump a complete set of web query data and server environment information as an error page. This could allow unintended disclosure of sensitive information.
A suggested fix is available [3] and the commit that caused the problem [4] was most likely introduced in version 4.19.
[1] https://rt.cpan.org/Public/Bug/Display.html?id=84403 [2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739505 [3] https://github.com/markstos/CGI--Application/pull/15 [4] https://github.com/markstos/CGI--Application/commit/61d327646f01fe
Other sources
The CGI::Application module before 4.5050 and 4.5051 for Perl, when run modes are not specified, allows remote attackers to obtain sensitive information (web queries and environment details) via vectors related to the dumphtml function.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-7329?
CVE-2013-7329 has been classified as a medium severity vulnerability due to its potential for unintended information disclosure.
How do I fix CVE-2013-7329?
To fix CVE-2013-7329, update the libcgi-application-perl package to version 4.61-1 or later.
What systems are affected by CVE-2013-7329?
CVE-2013-7329 affects versions of the CGI::Application perl module up to and including 4.50.
What type of vulnerability is CVE-2013-7329?
CVE-2013-7329 is an information disclosure vulnerability that can expose sensitive web query and server environment data.
Is CVE-2013-7329 exploitable remotely?
Yes, CVE-2013-7329 can be exploited remotely if an attacker can trigger the vulnerable component of the CGI::Application perl module.