CVE-2021-47156

Published: Mar 18, 2024Modified: Jun 17, 2026Deferred

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The Net::IPAddress::Util module before 5.000 for Perl does not properly consider extraneous zero characters in an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.

Related CWEs

CWE-1287

Improper Validation of Specified Type of Input

The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

References (6)

https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/

Source: cve@mitre.org

https://metacpan.org/release/Net-IPAddress-Util

Source: cve@mitre.org

https://metacpan.org/release/PWBENNETT/Net-IPAddress-Util-5.000/changes

Source: cve@mitre.org

https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/

Source: af854a3a-2127-422b-91ae-364da2661108

https://metacpan.org/release/Net-IPAddress-Util

Source: af854a3a-2127-422b-91ae-364da2661108

https://metacpan.org/release/PWBENNETT/Net-IPAddress-Util-5.000/changes

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.