NetSight
IP …
medium6.8

CVE-2013-4407

HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first "." character…

Impact

HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.

Affected products

VendorProductAffected versions
Http-Body ProjectHttp-Body
through 1.17
Versions 0.01, 0.2, 0.03, 0.4, 0.5

References