CVE-2013-4407

Summary

CVE	CVE-2013-4407
State	PUBLISHED
Assigner	redhat
Source Priority	CVE Program / NVD first with legacy fallback
Published	2013-11-23 18:55:04 UTC
Updated	2026-04-29 01:13:23 UTC
Description	HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.

Primary CVSS: v2.0 6.8 from [email protected]

AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS: 0.008300000 probability, percentile 0.746070000 (date 2026-04-29)

Problem Types: NVD-CWE-noinfo | n/a

Access Vector

Network

Access Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

AV:N/AC:M/Au:N/C:P/I:P/A:P

Type	Vendor	Product	Version	Update	Edition	Language
Application	Http-body Project	Http-body	0.01	All	All	All
Application	Http-body Project	Http-body	0.03	All	All	All
Application	Http-body Project	Http-body	0.2	All	All	All
Application	Http-body Project	Http-body	0.4	All	All	All
Application	Http-body Project	Http-body	0.5	All	All	All
Application	Http-body Project	Http-body	0.6	All	All	All
Application	Http-body Project	Http-body	0.7	All	All	All
Application	Http-body Project	Http-body	0.8	All	All	All
Application	Http-body Project	Http-body	0.9	All	All	All
Application	Http-body Project	Http-body	1.00	All	All	All
Application	Http-body Project	Http-body	1.01	All	All	All
Application	Http-body Project	Http-body	1.02	All	All	All
Application	Http-body Project	Http-body	1.03	All	All	All
Application	Http-body Project	Http-body	1.04	All	All	All
Application	Http-body Project	Http-body	1.05	All	All	All
Application	Http-body Project	Http-body	1.06	All	All	All
Application	Http-body Project	Http-body	1.07	All	All	All
Application	Http-body Project	Http-body	1.08	All	All	All
Application	Http-body Project	Http-body	1.09	All	All	All
Application	Http-body Project	Http-body	1.10	All	All	All
Application	Http-body Project	Http-body	1.11	All	All	All
Application	Http-body Project	Http-body	1.12	All	All	All
Application	Http-body Project	Http-body	1.14	All	All	All
Application	Http-body Project	Http-body	1.15	All	All	All
Application	Http-body Project	Http-body	1.16	All	All	All
Application	Http-body Project	Http-body	All	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified

Reference	Source	Link	Tags
git.shadowcat.co.uk/gitweb/gitweb.cgi	af854a3a-2127-422b-91ae-364da2661108	git.shadowcat.co.uk
git.shadowcat.co.uk/gitweb/gitweb.cgi	af854a3a-2127-422b-91ae-364da2661108	git.shadowcat.co.uk
#721634 - libhttp-body-perl: CVE-2013-4407: HTTP::Body::Multipart critical security bug - Debian Bug report logs	af854a3a-2127-422b-91ae-364da2661108	bugs.debian.org
metacpan.org/release/GETTY/HTTP-Body-1.23	af854a3a-2127-422b-91ae-364da2661108	metacpan.org
www.openwall.com/lists/oss-security/2024/04/07/1	af854a3a-2127-422b-91ae-364da2661108	www.openwall.com
Debian -- Security Information -- DSA-2801-1 libhttp-body-perl	af854a3a-2127-422b-91ae-364da2661108	www.debian.org
www.openwall.com/lists/oss-security/2024/04/07/1	af854a3a-2127-422b-91ae-364da2661108	www.openwall.com
[security-announce] openSUSE-SU-2014:0433-1: important: perl-HTTP-Body:	af854a3a-2127-422b-91ae-364da2661108	lists.opensuse.org
:http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits/HTTP-Body.git;a=commit;h=13ac5b23c083bc56e32dd706ca02fca292bd2161	MITRE	git.shadowcat.co.uk
:http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits/HTTP-Body.git;a=commit;h=cc75c886256f187cda388641931e8dafad6c2346	MITRE	git.shadowcat.co.uk
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.