CVE-2013-4407
HTTP::Body::Multipart in the HTTP-Body 1.08, 1.17, and earlier module for Perl uses the part of...
HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.
Exploit likelihood
What each source reports
NVD Score used
HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.
- Record
CVE-2013-4407- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.
- Record
CVE-2013-4407- Updated
- 2026-11-02
EUVDEUVD-2013-4286 No score
HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.
- Record
EUVD-2013-4286- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8v7w-j6g2-p6j2 No score
HTTP::Body::Multipart in the HTTP-Body 1.08, 1.17, and earlier module for Perl uses the part of...
HTTP::Body::Multipart in the HTTP-Body 1.08, 1.17, and earlier module for Perl uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.
- Record
GHSA-8v7w-j6g2-p6j2- Updated
- 2026-11-02
OSVALPINE-CVE-2013-4407 No score
HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.
- Record
ALPINE-CVE-2013-4407- Updated
- 2026-11-02
OSV No score
HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.
- Record
CVE-2013-4407- Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2013-4407 No score
HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.
- Record
DEBIAN-CVE-2013-4407- Updated
- 2026-11-02
OSVMGASA-2013-0352 No score
Updated perl-HTTP-Body packages fix CVE-2013-4407
Updated perl-HTTP-Body package fixes security vulnerability:
Jonathan Dolle reported a design error in HTTP::Body, a Perl module for processing data from HTTP POST requests. The HTTP body multipart parser creates temporary files which preserve the suffix of the uploaded file. An attacker able to upload files to a service that uses HTTP::Body::Multipart could potentially execute commands on the server if these temporary filenames are used in subsequent commands without further checks (CVE-2013-4407).
- Record
MGASA-2013-0352- Updated
- 2026-11-02
OSVMGASA-2024-0127 No score
Updated perl-HTTP-Body packages fix security vulnerability
HTTP::Body::Multipart in the HTTP-Body 1.08, 1.17, and earlier module for Perl uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed. (CVE-2013-4407)
- Record
MGASA-2024-0127- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10492-1 No score
perl-HTTP-Body-1.22-1.4 on GA media
These are all security issues fixed in the perl-HTTP-Body-1.22-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10492-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-4407 No score
HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.
- Record
UBUNTU-CVE-2013-4407- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
perl-http-bodyAlpine:v3.16 |
before 1.22-r2, plus listed versions 1.12-r01.15-r01.17-r01.22-r01.22-r1 |
1.22-r2 |
perl-http-bodyAlpine:v3.17 |
before 1.22-r2, plus listed versions 1.12-r01.15-r01.17-r01.22-r01.22-r1 |
1.22-r2 |
perl-http-bodyAlpine:v3.18 |
before 1.22-r3, plus listed versions 1.12-r01.15-r01.17-r01.22-r01.22-r11.22-r2 |
1.22-r3 |
perl-http-bodyAlpine:v3.19 |
before 1.22-r4, plus listed versions 1.12-r01.15-r01.17-r01.22-r01.22-r11.22-r21.22-r3 |
1.22-r4 |
libhttp-body-perlDebian:12 |
before 1.17-2 | 1.17-2 |
libhttp-body-perlDebian:13 |
before 1.17-2 | 1.17-2 |
libhttp-body-perlDebian:14 |
before 1.17-2 | 1.17-2 |
libhttp-body-perlDebian:7 |
before 1.11-1+deb7u1, plus listed versions 1.11-1 |
1.11-1+deb7u1 |
perl-HTTP-BodyMageia:2 |
before 1.150.0-1.1.mga2 | 1.150.0-1.1.mga2 |
perl-HTTP-BodyMageia:3 |
before 1.170.0-2.1.mga3 | 1.170.0-2.1.mga3 |
perl-HTTP-BodyMageia:9 |
before 1.230.0-1.mga9 | 1.230.0-1.mga9 |
perl-HTTP-BodyopenSUSE:Tumbleweed |
before 1.22-1.4 | 1.22-1.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4407 is a medium vulnerability (CVSS 6.8) in Http-body Project Http-body, published November 21, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.88%, the 86th percentile. Fixed in perl-http-body 1.22-r2.
References
bugs.debian.org/cgi-bin/bugreport.cgi?bug=721634
lists.opensuse.org/opensuse-security-announce/2014-03/msg00018.html
debian.org/security/2013/dsa-2801
metacpan.org/release/GETTY/HTTP-Body-1.23
openwall.com/lists/oss-security/2024/04/07/1
git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits/HTTP-Body.git%3Ba=commit%3Bh=13ac5b23c083bc56e32dd706ca02fca292bd2161
Show 14 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-4407
github.com/advisories/GHSA-8v7w-j6g2-p6j2
security.alpinelinux.org/vuln/CVE-2013-4407
security-tracker.debian.org/tracker/CVE-2013-4407
advisories.mageia.org/MGASA-2013-0352.html
bugs.mageia.org/show_bug.cgi?id=11727
ubuntu.com/security/CVE-2013-4407
cve.org/CVERecord?id=CVE-2013-4407
suse.com/security/cve/CVE-2013-4407