CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 7.2
CWE Name:  Permissions Privileges and Access Controls
Summary: (1) cpan/archive-tar/bin/ptar, (2) cpan/archive-tar/bin/ptardiff, (3) cpan/archive-tar/bin/ptargrep, (4) cpan/cpan/scripts/cpan, (5) cpan/digest-sha/shasum, (6) cpan/encode/bin/enc2xs, (7) cpan/encode/bin/encguess, (8) cpan/encode/bin/piconv, (9) cpan/encode/bin/ucmlint, (10) cpan/encode/bin/unidump, (11) cpan/extutils-makemaker/bin/instmodsh, (12) cpan/io-compress/bin/zipdetails, (13) cpan/json-pp/bin/json_pp, (14) cpan/test-harness/bin/prove, (15) dist/extutils-parsexs/lib/extutils/xsubpp, (16) dist/module-corelist/corelist, (17) ext/pod-html/bin/pod2html, (18) utils/c2ph.pl, (19) utils/h2ph.pl, (20) utils/h2xs.pl, (21) utils/libnetcfg.pl, (22) utils/perlbug.pl, (23) utils/perldoc.pl, (24) utils/perlivp.pl, and (25) utils/splain.pl in perl 5.x before 5.22.3-rc2 and 5.24 before 5.24.1-rc2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a trojan horse module under the current working directory.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: LOCAL
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2016-08-02
Last Modified Date: 2018-12-16