CVE-2013-1437
Eval injection vulnerability in the Module-Metadata module before 1.000015 for Perl allows remote...
Eval injection vulnerability in the Module-Metadata module before 1.000015 for Perl allows remote attackers to execute arbitrary Perl code via the $Version value.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Eval injection vulnerability in the Module-Metadata module before 1.000015 for Perl allows remote attackers to execute arbitrary Perl code via the $Version value.
- Record
CVE-2013-1437- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-74
- Updated
- 2026-11-02
CVE List No score
Eval injection vulnerability in the Module-Metadata module before 1.000015 for Perl allows remote attackers to execute arbitrary Perl code via the $Version value.
- Record
CVE-2013-1437- Updated
- 2026-11-02
EUVDEUVD-2013-1475 No score
Eval injection vulnerability in the Module-Metadata module before 1.000015 for Perl allows remote attackers to execute arbitrary Perl code via the $Version value.
- Record
EUVD-2013-1475- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-86v9-w7h5-78qj No score
Eval injection vulnerability in the Module-Metadata module before 1.000015 for Perl allows remote...
Eval injection vulnerability in the Module-Metadata module before 1.000015 for Perl allows remote attackers to execute arbitrary Perl code via the $Version value.
- Record
GHSA-86v9-w7h5-78qj- Updated
- 2026-11-02
OSV
Eval injection vulnerability in the Module-Metadata module before 1.000015 for Perl allows remote attackers to execute arbitrary Perl code via the $Version value.
- Record
CVE-2013-1437- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-1437
Eval injection vulnerability in the Module-Metadata module before 1.000015 for Perl allows remote attackers to execute arbitrary Perl code via the $Version value.
- Record
DEBIAN-CVE-2013-1437- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2014-0093 No score
Updated perl-Module-Metadata package clarifies the man page
This update clarifies the module's documentation about the code it executes i.e. it does "eval" a module to determine its version number. Previously it said that it did not execute unsafe code (CVE-2013-1437).
- Record
MGASA-2014-0093- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10177-1 No score
perl-Module-Metadata-1.000033-1.1 on GA media
These are all security issues fixed in the perl-Module-Metadata-1.000033-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10177-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libmodule-metadata-perlDebian:12 |
before 1.000015-1 | 1.000015-1 |
libmodule-metadata-perlDebian:13 |
before 1.000015-1 | 1.000015-1 |
libmodule-metadata-perlDebian:14 |
before 1.000015-1 | 1.000015-1 |
perlDebian:12 |
before 5.18.1-2 | 5.18.1-2 |
perlDebian:13 |
before 5.18.1-2 | 5.18.1-2 |
perlDebian:14 |
before 5.18.1-2 | 5.18.1-2 |
perl-Module-MetadataMageia:3 |
before 1.0.11-4.1.mga3 | 1.0.11-4.1.mga3 |
perl-Module-MetadataopenSUSE:Tumbleweed |
before 1.000033-1.1 | 1.000033-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-1437 is a critical vulnerability (CVSS 9.8) in Module-metadata Project Module-metadata, published February 25, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.94%, the 87th percentile. Fixed in libmodule-metadata-perl 1.000015-1.
References
metacpan.org/changes/distribution/Module-Metadata
lists.fedoraproject.org/pipermail/package-announce/2013-August/114904.html
nvd.nist.gov/vuln/detail/CVE-2013-1437
github.com/advisories/GHSA-86v9-w7h5-78qj
security-tracker.debian.org/tracker/CVE-2013-1437
advisories.mageia.org/MGASA-2014-0093.html
bugs.mageia.org/show_bug.cgi?id=11146
suse.com/security/cve/CVE-2013-1437