CVE-2008-7319
9.8
CRITICAL · CVSS 3.0 · EPSS 6.2% (pctl 93)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
The Net::Ping::External extension through 0.15 for Perl does not properly sanitize arguments (e.g., invalid hostnames) containing shell metacharacters before use of backticks in External.pm, allowing for shell command injection and arbitrary command execution if untrusted input is used.
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 6.19% — more likely to be exploited than 93% of all CVEs |
| Weakness | CWE-77 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2017-11-07 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| net-ping-external project | net-ping-external |
References
- http://matthias.sdfeu.org/devel/net-ping-external-cmd-injection.patch
- http://www.openwall.com/lists/oss-security/2017/11/07/4
- https://bugs.debian.org/881097
- https://rt.cpan.org/Public/Bug/Display.html?id=33230
- http://matthias.sdfeu.org/devel/net-ping-external-cmd-injection.patch
- http://www.openwall.com/lists/oss-security/2017/11/07/4
- https://bugs.debian.org/881097
- https://rt.cpan.org/Public/Bug/Display.html?id=33230
→ the Explorer · watch your stack · NVD