Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-31484

26
FAUCET Score

CVE-2023-31484 describes a critical vulnerability in CPAN.pm versions prior to 2.35, affecting various Perl distributions, where TLS certificates are not validated during HTTPS downloads. This allows for a high-complexity network attack with no user interaction, potentially leading to high impact on confidentiality, integrity, and availability. While the CVSS score is 8.1 (High), there is currently no public exploit code, active exploitation, or significant community discussion surrounding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.35CPE matchmatch criteria
cpe:2.3:a:cpanpm_project:cpanpm:*:*:*:*:*:*:*:*
< 5.38.0CPE matchmatch criteria
cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

8.1HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
2.2
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.55%
Probability of exploitation in next 30 days
EPSS Percentile
72.5%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0155 is in the 30th percentile among its peer group of 8,918 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (7)

microsoftpatch availablevia msrc
Product: cbl2 perl 5.34.1-489 on CBL Mariner 2.0Fixed in: 5.34.1-489
microsoftpatch availablevia msrc
Product: 19954-17086Fixed in: 5.34.1-489
microsoftpatch availablevia msrc
Product: 17843-16823Fixed in: 5.34.1-489
microsoftpatch availablevia msrc
Product: cbl2 perl 5.34.1-490 on CBL Mariner 2.0Fixed in: 5.34.1-489
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: perl-CPAN-0:2.18-399.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7 Extended Lifecycle SupportFixed in: perl-4:5.16.3-299.el7_9.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: perl-CPAN-0:2.29-3.el9
View patch

Vendor Advisories (2)

redhatCVE-2023-31484Moderate

perl: CPAN.pm does not verify TLS certificates when downloading distributions over HTTPS

Apr 29, 2023
microsoft2023-Apr/CVE-2023-31484Important

CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.

Apr 11, 2023

References

lists.debian.org / debian-lts-announce/2024/10/msg00017.html
blog.hackeriet.no / perl-http-tiny-insecure-tls-default-affects-cpan-modules
MitigationPatchThird Party Advisory
github.com / andk/cpanpm/pull/175
ExploitIssue Tracking
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/BM6UW55CNFUTNGD5ZRKGUKKKFDJGMFHL
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/LEGCEOKFJVBJ2QQ6S2H4NAEWTUERC7SB
metacpan.org / dist/CPAN/changes
Release Notes
security.netapp.com / advisory/ntap-20240621-0007
openwall.com / lists/oss-security/2023/04/18/14
Mailing ListPatch
openwall.com / lists/oss-security/2023/04/29/1
Mailing ListPatch
openwall.com / lists/oss-security/2023/05/03/3
Mailing ListPatch
openwall.com / lists/oss-security/2023/05/03/5
Mailing List
openwall.com / lists/oss-security/2023/05/07/2
Mailing List