CVE-2017-16248

Description

The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathname, which differs from the intended policy of allowing access only when the filename itself has a '.' character.

Weakness classification

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references

• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Release Notes
• cve@mitre.org — Issue Tracking, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes
• af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory