CVE-2011-10043 (GCVE-0-2011-10043)

Vulnerability from cvelistv5 – Published: 2026-07-07 11:46 – Updated: 2026-07-07 16:04
VLAI
Title
Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded
Summary
Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Module names starting with "::" could be passed to the load function to specify arbitrary module paths. Attackers able to influence module names passed to load could use that bug to execute arbitrary code.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-145 - Improper Neutralization of Section Delimiters
Assigner
References
Impacted products
Vendor Product Version
BINGOS Module::Load Affected: 0 , < 0.22 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2011-10043",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-07T16:04:25.108284Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-07T16:04:29.197Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "Module-Load",
          "product": "Module::Load",
          "programFiles": [
            "lib/Module/Load.pm"
          ],
          "programRoutines": [
            {
              "name": "Module::Load::_to_file"
            }
          ],
          "repo": "https://github.com/jib/module-load",
          "vendor": "BINGOS",
          "versions": [
            {
              "lessThan": "0.22",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded.\n\nModule names starting with \"::\" could be passed to the load function to specify arbitrary module paths.\n\nAttackers able to influence module names passed to load could use that bug to execute arbitrary code."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-242 Code Injection"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-145",
              "description": "CWE-145 Improper Neutralization of Section Delimiters",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-07T11:46:13.575Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-or-bad-interfaces-make-good-people-do-bad-things.html"
        },
        {
          "url": "https://metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.20/lib/Module/Load.pm"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/BINGOS/Module-Load-0.22/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "If you are using Perl v5.15.3 or earlier, then upgrade to Module::Load 0.22 or later.\n\nPerl versions after v5.15.4 include newer versions of Module::Load that fix this issue."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2011-10-02T00:00:00.000Z",
          "value": "General issue identified by Michael G Schwern in blog post."
        },
        {
          "lang": "en",
          "time": "2011-10-04T00:00:00.000Z",
          "value": "Module::Load 0.22 released."
        },
        {
          "lang": "en",
          "time": "2011-10-20T00:00:00.000Z",
          "value": "Perl v5.15.4 released with Module::Load 0.22."
        }
      ],
      "title": "Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2011-10043",
    "datePublished": "2026-07-07T11:46:13.575Z",
    "dateReserved": "2026-07-05T11:47:35.949Z",
    "dateUpdated": "2026-07-07T16:04:29.197Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2011-10043",
      "date": "2026-07-09",
      "epss": "0.00429",
      "percentile": "0.34544"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2011-10043\",\"sourceIdentifier\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\",\"published\":\"2026-07-07T12:16:24.880\",\"lastModified\":\"2026-07-07T17:16:31.890\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded.\\n\\nModule names starting with \\\"::\\\" could be passed to the load function to specify arbitrary module paths.\\n\\nAttackers able to influence module names passed to load could use that bug to execute arbitrary code.\"}],\"affected\":[{\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\",\"affectedData\":[{\"vendor\":\"BINGOS\",\"product\":\"Module::Load\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://cpan.org/modules\",\"packageName\":\"Module-Load\",\"programFiles\":[\"lib/Module/Load.pm\"],\"programRoutines\":[{\"name\":\"Module::Load::_to_file\"}],\"repo\":\"https://github.com/jib/module-load\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"0.22\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-07T16:04:25.108284Z\",\"id\":\"CVE-2011-10043\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-145\"}]}],\"references\":[{\"url\":\"https://blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-or-bad-interfaces-make-good-people-do-bad-things.html\",\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\"},{\"url\":\"https://metacpan.org/release/BINGOS/Module-Load-0.22/changes\",\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\"},{\"url\":\"https://metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.20/lib/Module/Load.pm\",\"source\":\"9b29abf9-4ab0-4765-b253-1875cd9b441e\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2011-10043\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-07T16:04:25.108284Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-07T16:04:03.424Z\"}}], \"cna\": {\"title\": \"Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"capecId\": \"CAPEC-242\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-242 Code Injection\"}]}], \"affected\": [{\"repo\": \"https://github.com/jib/module-load\", \"vendor\": \"BINGOS\", \"product\": \"Module::Load\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"0.22\", \"versionType\": \"custom\"}], \"packageName\": \"Module-Load\", \"programFiles\": [\"lib/Module/Load.pm\"], \"collectionURL\": \"https://cpan.org/modules\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"Module::Load::_to_file\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2011-10-02T00:00:00.000Z\", \"value\": \"General issue identified by Michael G Schwern in blog post.\"}, {\"lang\": \"en\", \"time\": \"2011-10-04T00:00:00.000Z\", \"value\": \"Module::Load 0.22 released.\"}, {\"lang\": \"en\", \"time\": \"2011-10-20T00:00:00.000Z\", \"value\": \"Perl v5.15.4 released with Module::Load 0.22.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"If you are using Perl v5.15.3 or earlier, then upgrade to Module::Load 0.22 or later.\\n\\nPerl versions after v5.15.4 include newer versions of Module::Load that fix this issue.\"}], \"references\": [{\"url\": \"https://blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-or-bad-interfaces-make-good-people-do-bad-things.html\", \"tags\": [\"technical-description\"]}, {\"url\": \"https://metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.20/lib/Module/Load.pm\"}, {\"url\": \"https://metacpan.org/release/BINGOS/Module-Load-0.22/changes\", \"tags\": [\"release-notes\"]}], \"x_generator\": {\"engine\": \"cpansec-cna-tool 0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded.\\n\\nModule names starting with \\\"::\\\" could be passed to the load function to specify arbitrary module paths.\\n\\nAttackers able to influence module names passed to load could use that bug to execute arbitrary code.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-145\", \"description\": \"CWE-145 Improper Neutralization of Section Delimiters\"}]}], \"providerMetadata\": {\"orgId\": \"9b29abf9-4ab0-4765-b253-1875cd9b441e\", \"shortName\": \"CPANSec\", \"dateUpdated\": \"2026-07-07T11:46:13.575Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2011-10043\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-07T16:04:29.197Z\", \"dateReserved\": \"2026-07-05T11:47:35.949Z\", \"assignerOrgId\": \"9b29abf9-4ab0-4765-b253-1875cd9b441e\", \"datePublished\": \"2026-07-07T11:46:13.575Z\", \"assignerShortName\": \"CPANSec\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.