Vulnerability Details : CVE-2023-31486
HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.
Products affected by CVE-2023-31486
- cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*
- cpe:2.3:a:http\:\:tiny_project:http\:\:tiny:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-31486
3.87%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 87 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-31486
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
8.1
|
HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
2.2
|
5.9
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2025-01-31 |
|
8.1
|
HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
2.2
|
5.9
|
NIST |
CWE ids for CVE-2023-31486
-
The product does not validate, or incorrectly validates, a certificate.Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2023-31486
-
https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
Perl's HTTP::Tiny has insecure TLS default, affecting CPAN.pm and other modules – Hackeriet BlogMitigation;Patch;Third Party Advisory
-
https://www.openwall.com/lists/oss-security/2023/05/03/4
oss-security - Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modulesMailing List;Third Party Advisory
-
https://hackeriet.github.io/cpan-http-tiny-overview/
HTTP::Tiny, verify_SSL=>0 default, and CPAN distributionsProduct
-
https://github.com/chansen/p5-http-tiny/pull/153
Change verify_SSL default to 1, add ENV var to enable insecure default [CVE-2023-31486] by stigtsp · Pull Request #153 · chansen/p5-http-tiny · GitHubPatch
-
https://www.openwall.com/lists/oss-security/2023/04/18/14
oss-security - Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modulesMailing List;Patch
-
http://www.openwall.com/lists/oss-security/2023/05/03/5
oss-security - Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modulesMailing List
-
http://www.openwall.com/lists/oss-security/2023/05/03/3
oss-security - Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modulesMailing List;Patch
-
https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/
Reddit - Dive into anythingIssue Tracking
-
https://security.netapp.com/advisory/ntap-20241129-0011/
CVE-2023-31486 Perl Vulnerability in NetApp Products | NetApp Product Security
-
http://www.openwall.com/lists/oss-security/2023/04/29/1
oss-security - Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modulesMailing List;Patch
-
http://www.openwall.com/lists/oss-security/2023/05/07/2
oss-security - Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modulesMailing List;Third Party Advisory
Jump to