High severity · published Mar 31, 2021
CVE-2021-29662
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations)…
7.5
CVSS
2.2%
EPSS
No
On KEV
Description
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
Data::validate::ip · Data::validate::ip Project
through 0.29 · source: NVD
SN
Snapcenter · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-29662
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-29662
Exploit
https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/
Product
https://github.com/houseabsolute/Data-Validate-IP
Patch
https://github.com/houseabsolute/Data-Validate-IP/commit/3bba13c819d616514a75e089badd75002fd4f14e
Exploit
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-018.md
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210604-0002/
Exploit
https://sick.codes/sick-2021-018/