Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2011-10007

Summary
Assigner-CPANSec
Assigner Org ID-9b29abf9-4ab0-4765-b253-1875cd9b441e
Published At-05 Jun, 2025 | 11:57
Updated At-11 Jun, 2025 | 12:27
Rejected At-
Credits

File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when `grep()` encounters a crafted file name

File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when `grep()` encounters a crafted filename. A file handle is opened with the 2 argument form of `open()` allowing an attacker controlled filename to provide the MODE parameter to `open()`, turning the filename into a command to be executed. Example: $ mkdir /tmp/poc; echo > "/tmp/poc/|id" $ perl -MFile::Find::Rule \     -E 'File::Find::Rule->grep("foo")->in("/tmp/poc")' uid=1000(user) gid=1000(user) groups=1000(user),100(users)

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:CPANSec
Assigner Org ID:9b29abf9-4ab0-4765-b253-1875cd9b441e
Published At:05 Jun, 2025 | 11:57
Updated At:11 Jun, 2025 | 12:27
Rejected At:
▼CVE Numbering Authority (CNA)
File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when `grep()` encounters a crafted file name

File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when `grep()` encounters a crafted filename. A file handle is opened with the 2 argument form of `open()` allowing an attacker controlled filename to provide the MODE parameter to `open()`, turning the filename into a command to be executed. Example: $ mkdir /tmp/poc; echo > "/tmp/poc/|id" $ perl -MFile::Find::Rule \     -E 'File::Find::Rule->grep("foo")->in("/tmp/poc")' uid=1000(user) gid=1000(user) groups=1000(user),100(users)

Affected Products
Vendor
RCLAMP
Product
File::Find::Rule
Collection URL
https://cpan.org/modules
Package Name
File-Find-Rule
Repo
https://github.com/richardc/perl-file-find-rule
Program Files
  • lib/File/Find/Rule.pm
Program Routines
  • grep
Default Status
unaffected
Versions
Affected
  • From 0 through 0.34 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-78CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Type: CWE
CWE ID: CWE-78
Description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Users should update to a fixed version such as 0.35 or later, or apply the patch provided in the references section, or use a patched version provided by their OS distribution

Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
A bug was reported by Kevin Ryde to the upstream RT bugtracker described as "grep() can truncate files".2011-01-04 23:00:00
CPANSec became aware of the bug and started triage. Code execution impact was confirmed, a patch was made, and the author, the distros list and additional downstream vendors were notified.2025-06-04 22:00:00
The author released File::Find::Rule 0.35.2025-06-05 15:32:01
Event: A bug was reported by Kevin Ryde to the upstream RT bugtracker described as "grep() can truncate files".
Date: 2011-01-04 23:00:00
Event: CPANSec became aware of the bug and started triage. Code execution impact was confirmed, a patch was made, and the author, the distros list and additional downstream vendors were notified.
Date: 2025-06-04 22:00:00
Event: The author released File::Find::Rule 0.35.
Date: 2025-06-05 15:32:01
Replaced By
Rejected Reason
References
HyperlinkResource
https://metacpan.org/release/RCLAMP/File-Find-Rule-0.34/source/lib/File/Find/Rule.pm#L423
N/A
https://rt.cpan.org/Public/Bug/Display.html?id=64504
issue-tracking
exploit
https://github.com/richardc/perl-file-find-rule/pull/4
issue-tracking
https://github.com/richardc/perl-file-find-rule/commit/df58128bcee4c1da78c34d7f3fe1357e575ad56f.patch
patch
Hyperlink: https://metacpan.org/release/RCLAMP/File-Find-Rule-0.34/source/lib/File/Find/Rule.pm#L423
Resource: N/A
Hyperlink: https://rt.cpan.org/Public/Bug/Display.html?id=64504
Resource:
issue-tracking
exploit
Hyperlink: https://github.com/richardc/perl-file-find-rule/pull/4
Resource:
issue-tracking
Hyperlink: https://github.com/richardc/perl-file-find-rule/commit/df58128bcee4c1da78c34d7f3fe1357e575ad56f.patch
Resource:
patch
▼Authorized Data Publishers (ADP)
1. CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
3.18.8HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Version: 3.1
Base score: 8.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/richardc/perl-file-find-rule/pull/4
exploit
Hyperlink: https://github.com/richardc/perl-file-find-rule/pull/4
Resource:
exploit
2. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://lists.debian.org/debian-lts-announce/2025/06/msg00006.html
N/A
http://www.openwall.com/lists/oss-security/2025/06/05/4
N/A
http://www.openwall.com/lists/oss-security/2025/06/06/1
N/A
http://www.openwall.com/lists/oss-security/2025/06/06/3
N/A
Hyperlink: https://lists.debian.org/debian-lts-announce/2025/06/msg00006.html
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2025/06/05/4
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2025/06/06/1
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2025/06/06/3
Resource: N/A
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:9b29abf9-4ab0-4765-b253-1875cd9b441e
Published At:05 Jun, 2025 | 12:15
Updated At:06 Jun, 2025 | 04:15

File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when `grep()` encounters a crafted filename. A file handle is opened with the 2 argument form of `open()` allowing an attacker controlled filename to provide the MODE parameter to `open()`, turning the filename into a command to be executed. Example: $ mkdir /tmp/poc; echo > "/tmp/poc/|id" $ perl -MFile::Find::Rule \     -E 'File::Find::Rule->grep("foo")->in("/tmp/poc")' uid=1000(user) gid=1000(user) groups=1000(user),100(users)

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.18.8HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Type: Secondary
Version: 3.1
Base score: 8.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CPE Matches
Weaknesses
CWE IDTypeSource
CWE-78Secondary9b29abf9-4ab0-4765-b253-1875cd9b441e
CWE ID: CWE-78
Type: Secondary
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://github.com/richardc/perl-file-find-rule/commit/df58128bcee4c1da78c34d7f3fe1357e575ad56f.patch9b29abf9-4ab0-4765-b253-1875cd9b441e
N/A
https://github.com/richardc/perl-file-find-rule/pull/49b29abf9-4ab0-4765-b253-1875cd9b441e
N/A
https://metacpan.org/release/RCLAMP/File-Find-Rule-0.34/source/lib/File/Find/Rule.pm#L4239b29abf9-4ab0-4765-b253-1875cd9b441e
N/A
https://rt.cpan.org/Public/Bug/Display.html?id=645049b29abf9-4ab0-4765-b253-1875cd9b441e
N/A
http://www.openwall.com/lists/oss-security/2025/06/05/4af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2025/06/06/1af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2025/06/06/3af854a3a-2127-422b-91ae-364da2661108
N/A
https://lists.debian.org/debian-lts-announce/2025/06/msg00006.htmlaf854a3a-2127-422b-91ae-364da2661108
N/A
https://github.com/richardc/perl-file-find-rule/pull/4134c704f-9b21-4f2e-91b3-4a467353bcc0
N/A
Hyperlink: https://github.com/richardc/perl-file-find-rule/commit/df58128bcee4c1da78c34d7f3fe1357e575ad56f.patch
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Resource: N/A
Hyperlink: https://github.com/richardc/perl-file-find-rule/pull/4
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Resource: N/A
Hyperlink: https://metacpan.org/release/RCLAMP/File-Find-Rule-0.34/source/lib/File/Find/Rule.pm#L423
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Resource: N/A
Hyperlink: https://rt.cpan.org/Public/Bug/Display.html?id=64504
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2025/06/05/4
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2025/06/06/1
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2025/06/06/3
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://lists.debian.org/debian-lts-announce/2025/06/msg00006.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://github.com/richardc/perl-file-find-rule/pull/4
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

52Records found
CVE-2019-6736
Matching Score-4
Assigner-Zero Day Initiative
ShareView Details
Matching Score-4
Assigner-Zero Day Initiative
CVSS Score-8.8||HIGH
EPSS-1.93% / 82.62%
||
7 Day CHG~0.00%
Published-03 Jun, 2019 | 18:07
Updated-04 Aug, 2024 | 20:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of tiscript. When processing the System.Exec method the application does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7234.

Action-Not Available
Vendor-Bitdefender
Product-safepaySafePay
CWE ID-CWE-356
Product UI does not Warn User of Unsafe Actions
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2015-5958
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-40.68% / 97.27%
||
7 Day CHG~0.00%
Published-31 Aug, 2017 | 22:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

phpFileManager 0.9.8 allows remote attackers to execute arbitrary commands via a crafted URL.

Action-Not Available
Vendor-phpfilemanager_projectn/a
Product-phpfilemanagern/a
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
  • Previous
  • 1
  • 2
  • Next
Details not found