CVE-2010-3438 Vulnerability Details

  /     /     /  

CVE-2010-3438 Metadata Quick Info

CVE Published: 12/11/2019 | CVE Updated: 07/08/2024 | CVE Year: 2010
Source: redhat | Vendor: libpoe-component-irc-perl | Product: libpoe-component-irc-perl
Status : PUBLISHED

---

CVE-2010-3438 Description

libpoe-component-irc-perl before v6.32 does not remove carriage returns and line feeds. This can be used to execute arbitrary IRC commands by passing an argument such as "some text\rQUIT" to the \'privmsg\' handler, which would cause the client to disconnect from the server.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID:
CWE Name: stripping of CR/LF allows arbitrary IRC command execution
Source: libpoe-component-irc-perl

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).