CVE-2021-36770

Description

Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.

Risk Information

Base Score

7.8

MODERATE

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.11

Associated Vulnerability

Vulnerability	OS Platform
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.2.4	Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 12.0.3	Windows
Practical Extraction and Report Language (USN-5033-1) perl_5.32.1-3ubuntu2.1_i386.deb	Linux
Practical Extraction and Report Language (USN-5033-1) perl_5.32.1-3ubuntu2.1_amd64.deb	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234