Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2023-47039
January 02, 2024
A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell ("cmd.exe"). When running an executable that uses the Windows Perl interpreter, Perl attempts to find and execute "cmd.exe" within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. This flaw allows an attacker with limited privileges to place"cmd.exe" in locations with weak permissions, such as "C:\ProgramData". By doing so, arbitrary code can be executed when an administrator attempts to use this executable from these compromised locations.
Additional Notes
The description of this vulnerability differs from MITRE.
Do you need more information?
Contact Us
CVSS v4
Base Score:
8.5
Attack Vector
LOCAL
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
7.8
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Heap-based Buffer Overflow
Out-of-bounds Write
EPSS
Base Score:
0.09