{"id":"CVE-2013-4407","aliases":["ALPINE-CVE-2013-4407","DEBIAN-CVE-2013-4407","DSA-2801-1","EUVD-2013-4286","GHSA-8v7w-j6g2-p6j2","MGASA-2013-0352","MGASA-2024-0127","UBUNTU-CVE-2013-4407","openSUSE-SU-2024:10492-1"],"status":"published","title":"HTTP::Body::Multipart in the HTTP-Body 1.08, 1.17, and earlier module for Perl uses the part of...","description":"HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first \".\" character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02877,"percentile":0.8692,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2013-11-21T00:00:00Z","modified":"2026-09-01T20:03:18Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"perl-http-body","fixed_in":["1.22-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"perl-http-body","fixed_in":["1.22-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"perl-http-body","fixed_in":["1.22-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"perl-http-body","fixed_in":["1.22-r4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libhttp-body-perl","fixed_in":["1.17-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libhttp-body-perl","fixed_in":["1.17-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libhttp-body-perl","fixed_in":["1.17-2"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"libhttp-body-perl","fixed_in":["1.11-1+deb7u1"],"sources":["osv"]},{"ecosystem":"Mageia:2","package":"perl-HTTP-Body","fixed_in":["1.150.0-1.1.mga2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"perl-HTTP-Body","fixed_in":["1.170.0-2.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"perl-HTTP-Body","fixed_in":["1.230.0-1.mga9"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-HTTP-Body","fixed_in":["1.22-1.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"perl-http-body","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22-r2"}]}],"versions":["1.12-r0","1.15-r0","1.17-r0","1.22-r0","1.22-r1"]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"perl-http-body","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22-r2"}]}],"versions":["1.12-r0","1.15-r0","1.17-r0","1.22-r0","1.22-r1"]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"perl-http-body","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22-r3"}]}],"versions":["1.12-r0","1.15-r0","1.17-r0","1.22-r0","1.22-r1","1.22-r2"]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"perl-http-body","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22-r4"}]}],"versions":["1.12-r0","1.15-r0","1.17-r0","1.22-r0","1.22-r1","1.22-r2","1.22-r3"]},{"source":"osv","ecosystem":"Debian:12","package":"libhttp-body-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libhttp-body-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libhttp-body-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17-2"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"libhttp-body-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11-1+deb7u1"}]}],"versions":["1.11-1"]},{"source":"osv","ecosystem":"Mageia:2","package":"perl-HTTP-Body","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.150.0-1.1.mga2"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"perl-HTTP-Body","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.170.0-2.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-HTTP-Body","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.230.0-1.mga9"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-HTTP-Body","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22-1.4"}]}]}],"products":[{"vendor":"http-body_project","product":"http-body"}],"references":[{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=721634","tags":["x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00018.html","tags":["x_transferred","web"]},{"url":"http://www.debian.org/security/2013/dsa-2801","tags":["x_transferred","advisory","web"]},{"url":"https://metacpan.org/release/GETTY/HTTP-Body-1.23/","tags":["x_transferred","web"]},{"url":"https://www.openwall.com/lists/oss-security/2024/04/07/1","tags":["x_transferred","web"]},{"url":"http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits/HTTP-Body.git%3Ba=commit%3Bh=13ac5b23c083bc56e32dd706ca02fca292bd2161","tags":["x_transferred","web"]},{"url":"http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits/HTTP-Body.git%3Ba=commit%3Bh=cc75c886256f187cda388641931e8dafad6c2346","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/04/07/1","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4407"},{"url":"https://metacpan.org/release/GETTY/HTTP-Body-1.23"},{"url":"http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits/HTTP-Body.git;a=commit;h=13ac5b23c083bc56e32dd706ca02fca292bd2161"},{"url":"http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits/HTTP-Body.git;a=commit;h=cc75c886256f187cda388641931e8dafad6c2346"},{"url":"https://github.com/advisories/GHSA-8v7w-j6g2-p6j2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2013-4407","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4407","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0352.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11727","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2024-0127.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33067","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4407","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4407","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4407","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-4407","description":"HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first \".\" character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.","status":"published","published":"2013-11-23T00:00:00Z","modified":"2024-08-06T16:45:14.008Z","updated_at":"2026-11-02T14:34:58.193873Z"}],"euvd":[{"id":"EUVD-2013-4286","description":"HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first \".\" character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.","status":"published","published":"2013-11-23T00:00:00Z","modified":"2024-08-06T16:45:14Z","updated_at":"2026-11-03T01:56:31.667445Z"}],"ghsa":[{"id":"GHSA-8v7w-j6g2-p6j2","title":"HTTP::Body::Multipart in the HTTP-Body 1.08, 1.17, and earlier module for Perl uses the part of...","description":"HTTP::Body::Multipart in the HTTP-Body 1.08, 1.17, and earlier module for Perl uses the part of the uploaded file's name after the first \".\" character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.","status":"published","published":"2022-05-17T04:48:11Z","modified":"2024-05-01T18:31:14Z","updated_at":"2026-11-02T14:57:15.605145Z"}],"nvd":[{"id":"CVE-2013-4407","description":"HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first \".\" character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.","status":"published","published":"2013-11-23T18:55:04.657Z","modified":"2026-06-16T23:57:10.523Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:44.596064Z"}],"osv":[{"id":"ALPINE-CVE-2013-4407","description":"HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first \".\" character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.","status":"published","published":"2013-11-23T18:55:04.657Z","modified":"2025-11-19T05:58:26.54203Z","updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"CVE-2013-4407","description":"HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first \".\" character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.","status":"published","published":"2013-11-23T18:55:04Z","modified":"2026-04-16T06:18:36.590574003Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-4407","description":"HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first \".\" character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.","status":"published","published":"2013-11-23T18:55:04.657Z","modified":"2026-09-01T20:03:18.673987153Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"DSA-2801-1","title":"libhttp-body-perl - design error","status":"published","published":"2013-11-21T00:00:00Z","modified":"2026-03-09T01:19:05.083818Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"MGASA-2013-0352","title":"Updated perl-HTTP-Body packages fix CVE-2013-4407","description":"Updated perl-HTTP-Body package fixes security vulnerability:\n\nJonathan Dolle reported a design error in HTTP::Body, a Perl module for\nprocessing data from HTTP POST requests. The HTTP body multipart parser\ncreates temporary files which preserve the suffix of the uploaded file.\nAn attacker able to upload files to a service that uses\nHTTP::Body::Multipart could potentially execute commands on the server\nif these temporary filenames are used in subsequent commands without\nfurther checks (CVE-2013-4407).\n","status":"published","published":"2013-11-22T19:20:13Z","modified":"2026-04-16T06:25:03.257907455Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2024-0127","title":"Updated perl-HTTP-Body packages fix security vulnerability","description":"HTTP::Body::Multipart in the HTTP-Body 1.08, 1.17, and earlier module\nfor Perl uses the part of the uploaded file's name after the first \".\"\ncharacter as the suffix of a temporary file, which makes it easier for\nremote attackers to conduct attacks by leveraging subsequent behavior\nthat may assume the suffix is well-formed. (CVE-2013-4407)\n","status":"published","published":"2024-04-13T16:56:38Z","modified":"2026-04-16T04:40:58.005252058Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:10492-1","title":"perl-HTTP-Body-1.22-1.4 on GA media","description":"These are all security issues fixed in the perl-HTTP-Body-1.22-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:54.434803Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"UBUNTU-CVE-2013-4407","description":"HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first \".\" character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.","status":"withdrawn","published":"2013-11-23T18:55:00Z","modified":"2025-07-16T07:17:08.898225Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}