CVE-2011-1487

CVE-2011-1487 describes a security bypass vulnerability in Perl versions 5.10.x, 5.11.x, and 5.12.x through 5.12.3, as well as 5.13.x through 5.13.11. Specifically, the lc, lcfirst, uc, and ucfirst functions fail to apply the taint attribute to their return values when processing tainted input. This flaw could allow attackers to bypass Perl's taint protection mechanism using specially crafted strings. The vulnerability has a CVSS score of 5.0, indicating a medium severity. It is easily exploitable over the network with low attack complexity, potentially leading to partial integrity impact by bypassing security controls, though without confidentiality or availability impact. While not listed on the CISA KEV catalog or currently active on the Hot List, an exploit for this vulnerability is publicly available on ExploitDB (EDB-35554). Despite this, there is no evidence of active exploitation, and the CVE has received minimal community discussion or media coverage.