CVE-2023-47039

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-47039
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-47039.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-47039
Downstream
Related
Published
2024-01-02T06:15:13.737Z
Modified
2026-04-10T05:04:02.489514Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable that uses the Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. This flaw allows an attacker with limited privileges to placecmd.exe in locations with weak permissions, such as C:\ProgramData. By doing so, arbitrary code can be executed when an administrator attempts to use this executable from these compromised locations.

References

Affected packages

Git / github.com/perl/perl5

Affected ranges

Type
GIT
Repo
https://github.com/perl/perl5
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
df9d952d734ef94233ed84af97ca318d7972eed0
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.32.1"
        }
    ]
}

Affected versions

Other
GitLive-blead
perl-5a2
perl-5a9
if-0.*
if-0.0603
if-0.0604
if-0.0605
perl-1.*
perl-1.0
perl-2.*
perl-2.0
perl-3.*
perl-3.000
perl-3.044
perl-4.*
perl-4.0.00
perl-4.0.36
perl-5.*
perl-5.000
perl-5.000o
perl-5.001
perl-5.001n
perl-5.002
perl-5.002_01
perl-5.003
perl-5.005
perl-5.6.0
perl-5.7.0
perl-5.7.1
perl-5.7.2
perl-5.7.3
perl-5.8.0
perl-5.9.0
perl-5.9.1
perl-5.9.2
perl-5.9.3
perl-5.9.4
perl-5.9.5
v5.*
v5.10.0
v5.11.0
v5.11.1
v5.11.3
v5.11.4
v5.11.5
v5.12.0
v5.12.0-RC0
v5.12.0-RC1
v5.12.0-RC2
v5.12.0-RC3
v5.12.0-RC4
v5.12.0-RC5
v5.13.0
v5.13.1
v5.13.10
v5.13.11
v5.13.2
v5.13.3
v5.13.4
v5.13.5
v5.13.6
v5.13.7
v5.13.8
v5.13.9
v5.14.0
v5.14.0-RC1
v5.14.0-RC2
v5.14.0-RC3
v5.15.0
v5.15.1
v5.15.2
v5.15.3
v5.15.4
v5.15.5
v5.15.9
v5.16.0
v5.16.0-RC1
v5.16.0-RC2
v5.17.0
v5.17.2
v5.17.4
v5.17.6
v5.17.7
v5.17.7.0
v5.17.8
v5.17.9
v5.18.0
v5.18.0-RC1
v5.18.0-RC2
v5.18.0-RC3
v5.18.0-RC4
v5.19.0
v5.19.1
v5.19.11
v5.19.2
v5.19.3
v5.19.5
v5.19.7
v5.20.0
v5.20.0-RC1
v5.21.0
v5.21.1
v5.21.10
v5.21.11
v5.21.4
v5.21.5
v5.21.6
v5.21.8
v5.21.9
v5.22.0
v5.22.0-RC1
v5.22.0-RC2
v5.23.0
v5.23.1
v5.23.2
v5.23.3
v5.23.4
v5.23.6
v5.23.7
v5.24.0
v5.24.0-RC1
v5.24.0-RC2
v5.24.0-RC3
v5.24.0-RC4
v5.24.0-RC5
v5.25.0
v5.25.11
v5.25.2
v5.25.3
v5.25.4
v5.25.5
v5.25.7
v5.25.9
v5.26.0
v5.26.0-RC2
v5.27.0
v5.27.10
v5.27.11
v5.27.3
v5.27.5
v5.27.6
v5.27.7
v5.27.8
v5.28.0
v5.28.0-RC1
v5.28.0-RC2
v5.28.0-RC3
v5.28.0-RC4
v5.29.0
v5.29.1
v5.29.10
v5.29.5
v5.29.6
v5.29.7
v5.29.8
v5.29.9
v5.30.0
v5.30.0-RC1
v5.30.0-RC2
v5.31.0
v5.31.1
v5.31.11
v5.31.2
v5.31.3
v5.31.4
v5.31.5
v5.31.7
v5.32.0
v5.32.0-RC1
v5.32.1-RC1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-47039.json"