Vulnerability-Lookup

CVE-2024-45321 (GCVE-0-2024-45321)

Vulnerability from cvelistv5 – Published: 2024-08-27 00:00 – Updated: 2024-09-06 13:33

Summary

The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-27 13:12 UTC

CWE

n/a
CWE-494 - Download of Code Without Integrity Check

Assigner

mitre mitre root

References

3 references

URL	Tags
https://security.metacpan.org/2024/08/26/cpanminu…
https://github.com/miyagawa/cpanminus/issues/611
https://github.com/miyagawa/cpanminus/pull/674

Impacted products

1 product

Vendor	Product	Version	CPE status
perl	cpanminus	Affected: 0 , ≤ 1.7047 (custom) cpe:2.3:a:perl:cpanminus::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:perl:cpanminus:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cpanminus",
            "vendor": "perl",
            "versions": [
              {
                "lessThanOrEqual": "1.7047",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-45321",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-27T13:12:14.251524Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-494",
                "description": "CWE-494 Download of Code Without Integrity Check",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-06T13:33:38.493Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-27T04:10:30.761Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://security.metacpan.org/2024/08/26/cpanminus-downloads-code-using-insecure-http.html"
        },
        {
          "url": "https://github.com/miyagawa/cpanminus/issues/611"
        },
        {
          "url": "https://github.com/miyagawa/cpanminus/pull/674"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-45321",
    "datePublished": "2024-08-27T00:00:00.000Z",
    "dateReserved": "2024-08-27T00:00:00.000Z",
    "dateUpdated": "2024-09-06T13:33:38.493Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-45321",
      "date": "2026-09-16",
      "epss": "0.00737",
      "percentile": "0.52778"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:app\\\\:\\\\:cpanminus_project:app\\\\:\\\\:cpanminus:*:*:*:*:*:perl:*:*\", \"versionEndIncluding\": \"1.7047\", \"matchCriteriaId\": \"E7633BA7-2A2E-45A8-9A0F-69E1E35D0D2A\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.\"}, {\"lang\": \"es\", \"value\": \"El paquete App::cpanminus hasta 1.7047 para Perl descarga c\\u00f3digo a trav\\u00e9s de HTTP inseguro, lo que permite la ejecuci\\u00f3n de c\\u00f3digo para atacantes de red.\"}]",
      "id": "CVE-2024-45321",
      "lastModified": "2024-12-05T18:47:30.633",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 5.9}, {\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2024-08-27T04:15:09.010",
      "references": "[{\"url\": \"https://github.com/miyagawa/cpanminus/issues/611\", \"source\": \"cve@mitre.org\", \"tags\": [\"Issue Tracking\"]}, {\"url\": \"https://github.com/miyagawa/cpanminus/pull/674\", \"source\": \"cve@mitre.org\", \"tags\": [\"Issue Tracking\", \"Patch\"]}, {\"url\": \"https://security.metacpan.org/2024/08/26/cpanminus-downloads-code-using-insecure-http.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-494\"}]}, {\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-494\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-45321\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2024-08-27T04:15:09.010\",\"lastModified\":\"2026-06-17T07:54:01.447\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.\"},{\"lang\":\"es\",\"value\":\"El paquete App::cpanminus hasta 1.7047 para Perl descarga c\u00f3digo a trav\u00e9s de HTTP inseguro, lo que permite la ejecuci\u00f3n de c\u00f3digo para atacantes de red.\"}],\"affected\":[{\"source\":\"cve@mitre.org\",\"affectedData\":[{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"perl\",\"product\":\"cpanminus\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:perl:cpanminus:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"1.7047\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-08-27T13:12:14.251524Z\",\"id\":\"CVE-2024-45321\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-494\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-494\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:app\\\\:\\\\:cpanminus_project:app\\\\:\\\\:cpanminus:*:*:*:*:*:perl:*:*\",\"versionEndIncluding\":\"1.7047\",\"matchCriteriaId\":\"E7633BA7-2A2E-45A8-9A0F-69E1E35D0D2A\"}]}]}],\"references\":[{\"url\":\"https://github.com/miyagawa/cpanminus/issues/611\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://github.com/miyagawa/cpanminus/pull/674\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://security.metacpan.org/2024/08/26/cpanminus-downloads-code-using-insecure-http.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T23:45:31+00:00",
      "cve": "CVE-2024-45321",
      "id": "CVE-2024-45321",
      "initial_release_date": "2024-08-27T04:15:09.010000+00:00",
      "product_status:fixed": "56",
      "product_status:known_affected": "15",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "perl-App-cpanminus: Insecure HTTP in App::cpanminus Allows Code Execution Vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-45321.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "critical",
      "current_release_date": "2025-05-01T05:25:23Z",
      "cve": "CVE-2024-45321",
      "id": "CVE-2024-45321",
      "initial_release_date": "2024-08-28T02:25:31Z",
      "product_status:recommended": "2",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-45321",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-45321.json",
      "version": "11"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-45321\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-27T13:12:14.251524Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:perl:cpanminus:*:*:*:*:*:*:*:*\"], \"vendor\": \"perl\", \"product\": \"cpanminus\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.7047\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-494\", \"description\": \"CWE-494 Download of Code Without Integrity Check\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-27T13:23:33.278Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"n/a\", \"product\": \"n/a\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"references\": [{\"url\": \"https://security.metacpan.org/2024/08/26/cpanminus-downloads-code-using-insecure-http.html\"}, {\"url\": \"https://github.com/miyagawa/cpanminus/issues/611\"}, {\"url\": \"https://github.com/miyagawa/cpanminus/pull/674\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"n/a\"}]}], \"providerMetadata\": {\"orgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"shortName\": \"mitre\", \"dateUpdated\": \"2024-08-27T04:10:30.761Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-45321\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-06T13:33:38.493Z\", \"dateReserved\": \"2024-08-27T00:00:00.000Z\", \"assignerOrgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"datePublished\": \"2024-08-27T00:00:00.000Z\", \"assignerShortName\": \"mitre\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

alsa-2024:10218

Vulnerability from osv_almalinux

Published

2024-11-25 00:00

Modified

2024-12-02 10:45

Summary

Moderate: perl-App-cpanminus security update

Details

Why? It's dependency free, requires zero configuration, and stands alone but it's maintainable and extensible with plug-ins and friendly to shell scripting. When running, it requires only 10 MB of RAM.

Security Fix(es):

perl-App-cpanminus: Insecure HTTP in App::cpanminus Allows Code Execution Vulnerability (CVE-2024-45321)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2024:10218	ADVISORY
	https://access.redhat.com/security/cve/CVE-2024-45321	REPORT
	https://bugzilla.redhat.com/2308078	REPORT
	https://errata.almalinux.org/9/ALSA-2024-10218.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "perl-App-cpanminus"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7044-14.1.el9_5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Why? It\u0027s dependency free, requires zero configuration, and stands alone but it\u0027s maintainable and extensible with plug-ins and friendly to shell scripting. When running, it requires only 10 MB of RAM.  \n\nSecurity Fix(es):  \n\n  * perl-App-cpanminus: Insecure HTTP in App::cpanminus Allows Code Execution Vulnerability (CVE-2024-45321)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2024:10218",
  "modified": "2024-12-02T10:45:53Z",
  "published": "2024-11-25T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2024:10218"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-45321"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2308078"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/9/ALSA-2024-10218.html"
    }
  ],
  "related": [
    "CVE-2024-45321"
  ],
  "summary": "Moderate: perl-App-cpanminus security update"
}

alsa-2024:10219

Vulnerability from osv_almalinux

Published

2024-11-25 00:00

Modified

2024-12-02 10:52

Summary

Moderate: perl-App-cpanminus:1.7044 security update

Details

The panminus is a script to get, unpack, build and install modules from CPAN.

Security Fix(es):

perl-App-cpanminus: Insecure HTTP in App::cpanminus Allows Code Execution Vulnerability (CVE-2024-45321)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2024:10219	ADVISORY
	https://access.redhat.com/security/cve/CVE-2024-45321	REPORT
	https://bugzilla.redhat.com/2308078	REPORT
	https://errata.almalinux.org/8/ALSA-2024-10219.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "perl-App-cpanminus"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7044-6.module_el8.10.0+3924+8d272be4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "perl-CPAN-DistnameInfo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.12-13.module_el8.6.0+2810+886f1911"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "perl-CPAN-Meta-Check"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.014-6.module_el8.10.0+3924+8d272be4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "perl-File-pushd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.014-6.module_el8.6.0+2851+b32f1bac"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "perl-Module-CPANfile"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1002-7.module_el8.6.0+2792+592c5e39"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "perl-Parse-PMFile"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.41-7.module_el8.6.0+2851+b32f1bac"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "perl-String-ShellQuote"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.04-24.module_el8.6.0+2810+886f1911"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "The panminus is a script to get, unpack, build and install modules from CPAN.  \n\nSecurity Fix(es):  \n\n  * perl-App-cpanminus: Insecure HTTP in App::cpanminus Allows Code Execution Vulnerability (CVE-2024-45321)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2024:10219",
  "modified": "2024-12-02T10:52:55Z",
  "published": "2024-11-25T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2024:10219"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-45321"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2308078"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2024-10219.html"
    }
  ],
  "related": [
    "CVE-2024-45321"
  ],
  "summary": "Moderate: perl-App-cpanminus:1.7044 security update"
}

FKIE_CVE-2024-45321

Vulnerability from fkie_nvd - Published: 2024-08-27 04:15 - Updated: 2026-06-17 07:54

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.

References

URL	Tags
cve@mitre.org	https://github.com/miyagawa/cpanminus/issues/611	Issue Tracking
cve@mitre.org	https://github.com/miyagawa/cpanminus/pull/674	Issue Tracking, Patch
cve@mitre.org	https://security.metacpan.org/2024/08/26/cpanminus-downloads-code-using-insecure-http.html	Exploit, Third Party Advisory

Impacted products

	Vendor	Product	Version
	app\	\	cpanminus_project

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:perl:cpanminus:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "cpanminus",
          "vendor": "perl",
          "versions": [
            {
              "lessThanOrEqual": "1.7047",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:app\\:\\:cpanminus_project:app\\:\\:cpanminus:*:*:*:*:*:perl:*:*",
              "matchCriteriaId": "E7633BA7-2A2E-45A8-9A0F-69E1E35D0D2A",
              "versionEndIncluding": "1.7047",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers."
    },
    {
      "lang": "es",
      "value": "El paquete App::cpanminus hasta 1.7047 para Perl descarga c\u00f3digo a trav\u00e9s de HTTP inseguro, lo que permite la ejecuci\u00f3n de c\u00f3digo para atacantes de red."
    }
  ],
  "id": "CVE-2024-45321",
  "lastModified": "2026-06-17T07:54:01.447",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-45321",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-08-27T13:12:14.251524Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-08-27T04:15:09.010",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/miyagawa/cpanminus/issues/611"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/miyagawa/cpanminus/pull/674"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://security.metacpan.org/2024/08/26/cpanminus-downloads-code-using-insecure-http.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-494"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-494"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-9MMM-86G7-VP9G

Vulnerability from github – Published: 2024-08-27 06:30 – Updated: 2024-08-27 15:32

Details

The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-45321"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-494",
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-27T04:15:09Z",
    "severity": "CRITICAL"
  },
  "details": "The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.",
  "id": "GHSA-9mmm-86g7-vp9g",
  "modified": "2024-08-27T15:32:46Z",
  "published": "2024-08-27T06:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45321"
    },
    {
      "type": "WEB",
      "url": "https://github.com/miyagawa/cpanminus/issues/611"
    },
    {
      "type": "WEB",
      "url": "https://github.com/miyagawa/cpanminus/pull/674"
    },
    {
      "type": "WEB",
      "url": "https://security.metacpan.org/2024/08/26/cpanminus-downloads-code-using-insecure-http.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

OPENSUSE-SU-2024:14291-1

Vulnerability from csaf_opensuse - Published: 2024-08-27 00:00 - Updated: 2024-08-27 00:00

Summary

perl-App-cpanminus-1.7047-2.1 on GA media

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2024-45321.

CVE-2024-45321

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Recommended: 4 products

Open the full advisory

RHSA-2024:10218

Vulnerability from csaf_redhat - Published: 2024-11-25 09:39 - Updated: 2026-06-30 03:18

Summary

Red Hat Security Advisory: perl-App-cpanminus security update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2024-45321.

CVE-2024-45321

A flaw was found in App::cpanminus (cpanm) through version 1.7047. The default configuration downloads Perl modules from CPAN using HTTP, which could allow an attacker to view or modify the content without the knowledge of the user. This issue could allow an attacker to execute malicious code if they have the ability to intercept and modify the content before it reaches to user.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Fixed: 2 products

https://access.redhat.com/errata/RHSA-2024:10218

Open the full advisory

RHSA-2024:10219

Vulnerability from csaf_redhat - Published: 2024-11-25 12:03 - Updated: 2026-06-30 03:18

Summary

Red Hat Security Advisory: perl-App-cpanminus:1.7044 security update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2024-45321.

CVE-2024-45321

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Fixed: 54 products

https://access.redhat.com/errata/RHSA-2024:10219

Open the full advisory

RHSA-2024_10218

Vulnerability from csaf_redhat - Published: 2024-11-25 09:39 - Updated: 2024-12-06 11:01

Summary

Red Hat Security Advisory: perl-App-cpanminus security update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2024-45321.

CVE-2024-45321

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Fixed: 2 products

https://access.redhat.com/errata/RHSA-2024:10218

Open the full advisory

RHSA-2024_10219

Vulnerability from csaf_redhat - Published: 2024-11-25 12:03 - Updated: 2024-12-06 11:01

Summary

Red Hat Security Advisory: perl-App-cpanminus:1.7044 security update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2024-45321.

CVE-2024-45321

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Fixed: 58 products

https://access.redhat.com/errata/RHSA-2024:10219

Open the full advisory

ubuntu-cve-2024-45321

Vulnerability from osv_ubuntu

Published

2024-08-27 04:15

Modified

2026-05-20 15:12

Summary

Details

The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.

Severity

9.8 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.1 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2024-45321	REPORT
	https://www.cve.org/CVERecord?id=CVE-2024-45321	REPORT
	https://security.metacpan.org/2024/08/26/cpanminu…	REPORT
	https://github.com/miyagawa/cpanminus/issues/611	REPORT
	https://github.com/miyagawa/cpanminus/pull/674	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "cpanminus",
            "binary_version": "1.7040-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "cpanminus",
        "purl": "pkg:deb/ubuntu/cpanminus@1.7040-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.7014-1",
        "1.7039-1",
        "1.7040-1",
        "1.7040-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "cpanminus",
            "binary_version": "1.7043-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "cpanminus",
        "purl": "pkg:deb/ubuntu/cpanminus@1.7043-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.7042-2",
        "1.7043-1",
        "1.7043-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "cpanminus",
            "binary_version": "1.7044-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "cpanminus",
        "purl": "pkg:deb/ubuntu/cpanminus@1.7044-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.7044-1",
        "1.7044-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "cpanminus",
            "binary_version": "1.7045-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "cpanminus",
        "purl": "pkg:deb/ubuntu/cpanminus@1.7045-1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.7044-2",
        "1.7045-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "cpanminus",
            "binary_version": "1.7047-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "cpanminus",
        "purl": "pkg:deb/ubuntu/cpanminus@1.7047-1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.7047-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "cpanminus",
            "binary_version": "1.7048-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "cpanminus",
        "purl": "pkg:deb/ubuntu/cpanminus@1.7048-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.7048-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "cpanminus",
            "binary_version": "1.7048-1build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "cpanminus",
        "purl": "pkg:deb/ubuntu/cpanminus@1.7048-1build1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.7048-1",
        "1.7048-1build1"
      ]
    }
  ],
  "aliases": [],
  "details": "The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.",
  "id": "UBUNTU-CVE-2024-45321",
  "modified": "2026-05-20T15:12:00Z",
  "published": "2024-08-27T04:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-45321"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45321"
    },
    {
      "type": "REPORT",
      "url": "https://security.metacpan.org/2024/08/26/cpanminus-downloads-code-using-insecure-http.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/miyagawa/cpanminus/issues/611"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/miyagawa/cpanminus/pull/674"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2024-45321"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-45321 (GCVE-0-2024-45321)

Vulnerability from osv_almalinux

Vulnerability from osv_almalinux

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature

Related by attack behaviour