CVE-2014-10402 describes a vulnerability in the Perl DBI module (versions through 1.643), specifically affecting DBD::File drivers. This flaw allows these drivers to access files outside of the intended directories specified by the f_dir attribute in the DSN, stemming from an incomplete fix for a prior CVE. Rated as Medium severity (CVSS 6.1), the vulnerability has a local attack vector with low complexity, potentially leading to high confidentiality impact and low availability impact. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.643CPE matchmatch criteria | cpe:2.3:a:perl:dbi:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
perl-dbi: Incomplete fix for CVE-2014-10401
Sep 16, 2020An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute in the data source name (DSN). NOTE: this issue exists because of an incomplete fix for CVE-2014-10401.
Sep 8, 2020