Untrusted search path in Perl - CVE-2023-47039
Published: November 27, 2023
Vulnerability identifier: #VU83509
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2023-47039
CWE-ID: CWE-426
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Perl
Affected software:
Perl
Perl
Detailed vulnerability description
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to usage of an untrusted search path. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData.
The vulnerability affects Windows installations only.
How to mitigate CVE-2023-47039
Install updates from vendor's website.