CVE-2007-1349: apache mod_perl Improper Input Validation

Modified

AliasesRHSA-2007:0395RHSA-2007:0396RHSA-2007:0486+2 more

Published 30-03-2007Last modified 07-08-2024

Some data may be incomplete

1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2007-1349 is a medium (CVSS 5.0) Improper Input Validation vulnerability in apache mod_perl. EPSS estimates a 10.42% chance of exploitation in the next 30 days, higher than 95.7% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

10.42%

0%100%

Medium · +0.31 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 1

OPENSUSE-SU-2024:10626-1 RHSA-2008:0261 RHSA-2008:0263 RHSA-2008:0523 RHSA-2008:0524 RHSA-2008:0630+1 more

Timeline

30-03-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

10.42%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

Increase +0.31 pp

From 10.11% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Redhat8 products

enterprise_linux_desktop3.0 | 4.0 | 5.0
enterprise_linux_eus4.5
enterprise_linux_server3.0 | 4.0 | 5.0
enterprise_linux_workstation3.0 | 4.0 | 5.0
satellite5.1

Show all 8

Apache1 product

mod_perl< 1.30 | ≥ 2.0.0, ≤ 2.0.11

Canonical1 product

ubuntu_linuxEOL6.06 | 6.10 | 7.04

Debian1 product

libapache2-mod-perl2< 2.0.2-5

4 vendors · 11 products

References

54 links

secunia.com/advisories/26231Third Party AdvisoryX Refsource SECUNIA
www.securitytracker.com/id?1018259VDB EntryX Refsource SECTRACKThird Party Advisory
secunia.com/advisories/25894Third Party AdvisoryX Refsource SECUNIA
rhn.redhat.com/errata/RHSA-2008-0630.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
rhn.redhat.com/errata/RHSA-2007-0395.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.redhat.com/support/errata/RHSA-2007-0486.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
secunia.com/advisories/31493Third Party AdvisoryX Refsource SECUNIA
www.gossamer-threads.com/lists/modperl/modperl/92739X Refsource MISCThird Party Advisory
www.redhat.com/support/errata/RHSA-2008-0627.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
svn.apache.org/repos/asf/perl/modperl/branches/1.x/ChangesX Refsource CONFIRMVendor Advisory

Show all 54 references

secunia.com/advisories/24839Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/33720Third Party AdvisoryX Refsource SECUNIA
www.ubuntu.com/usn/usn-488-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
secunia.com/advisories/31490Third Party AdvisoryX Refsource SECUNIA
www.novell.com/linux/security/advisories/2007_12_sr.htmlVendor AdvisoryX Refsource SUSEBroken Link
secunia.com/advisories/26084Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2007/1150VDB EntryX Refsource VUPENThird Party Advisory
secunia.com/advisories/25655Third Party AdvisoryX Refsource SECUNIA
sunsolve.sun.com/search/document.do?assetkey=1-77-1021508.1-1Vendor AdvisoryX Refsource SUNALERTBroken Link
support.avaya.com/elmodocs2/security/ASA-2007-293.htmX Refsource CONFIRMThird Party Advisory
secunia.com/advisories/24678Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/25110Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2007-0396.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.trustix.org/errata/2007/0023/Vendor AdvisoryX Refsource TRUSTIXBroken Link
www.mandriva.com/security/advisories?name=MDKSA-2007:083Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
secunia.com/advisories/33723Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/25730Third Party AdvisoryX Refsource SECUNIA
www.novell.com/linux/security/advisories/2007_8_sr.htmlVendor AdvisoryX Refsource SUSEBroken Link
secunia.com/advisories/26290Third Party AdvisoryX Refsource SECUNIA
exchange.xforce.ibmcloud.com/vulnerabilities/33312VDB EntryX Refsource XFThird Party Advisory
www.redhat.com/support/errata/RHSA-2008-0261.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
security.gentoo.org/glsa/glsa-200705-04.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
www.securityfocus.com/bid/23192VDB EntryX Refsource BIDThird Party Advisory
secunia.com/advisories/25072Third Party AdvisoryX Refsource SECUNIA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10987VDB EntrySignatureX Refsource OVALThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8349VDB EntrySignatureX Refsource OVALThird Party Advisory
secunia.com/advisories/25432Third Party AdvisoryX Refsource SECUNIA
sunsolve.sun.com/search/document.do?assetkey=1-66-248386-1Vendor AdvisoryX Refsource SUNALERTBroken Link
access.redhat.com/errata/RHSA-2007:0395Advisory
www.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=240423REPORT
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0395.jsonAdvisory
access.redhat.com/security/cve/CVE-2007-1349REPORT
www.cve.org/CVERecord?id=CVE-2007-1349Advisory
nvd.nist.gov/vuln/detail/CVE-2007-1349Advisory
access.redhat.com/errata/RHSA-2007:0396Advisory
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0396.jsonAdvisory
access.redhat.com/errata/RHSA-2007:0486Advisory
www.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0486.jsonAdvisory
access.redhat.com/errata/RHSA-2008:0627Advisory
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0627.jsonAdvisory
security-tracker.debian.org/tracker/CVE-2007-1349Advisory