CVE-2021-29662 : The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginni

The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.

Published 2021-03-31 18:15:16

Updated 2021-06-08 13:51:42

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2021-29662

EPSS FAQ

0.24%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 61 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-29662

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2021-29662

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-29662

https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-018.md

security/SICK-2021-018.md at master · sickcodes/security · GitHub
Exploit;Third Party Advisory
https://security.netapp.com/advisory/ntap-20210604-0002/

CVE-2021-29662 Perl Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/

Security Issues in Perl IP Address distros - House Absolute(ly) Pointless
Exploit;Third Party Advisory

CVEs referencing this url
https://github.com/houseabsolute/Data-Validate-IP/commit/3bba13c819d616514a75e089badd75002fd4f14e

Update security note in docs to include mention of is_ip() and friends · houseabsolute/Data-Validate-IP@3bba13c · GitHub
Patch;Third Party Advisory
https://github.com/houseabsolute/Data-Validate-IP

GitHub - houseabsolute/Data-Validate-IP: IPv4 and IPv6 validation methods
Product;Third Party Advisory
https://sick.codes/sick-2021-018/

CVE-2021-29662 - Perl module Data::Validate::IP - Improper Input Validation of octal literals in Perl Data::Validate::IP v0.29 and below results in indeterminate SSRF & RFI vulnerabilities. - Sick Cod
Exploit;Third Party Advisory

Products affected by CVE-2021-29662

Netapp » Snapcenter » Version: N/A
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
Matching versions
Data::validate::ip Project » Data::validate::ip » For Perl
Versions up to, including, (<=) 0.29
cpe:2.3:a:data\:\:validate\:\:ip_project:data\:\:validate\:\:ip:*:*:*:*:*:perl:*:*
Matching versions

Vulnerability Details : CVE-2021-29662

Exploit prediction scoring system (EPSS) score for CVE-2021-29662

CVSS scores for CVE-2021-29662

CWE ids for CVE-2021-29662

References for CVE-2021-29662

Products affected by CVE-2021-29662