CVE-2017-0374

High

Published: 23/05/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In the Config-Model library before version 2.102, there is a vulnerability that allows local users to gain elevated privileges via a crafted model in the current working directory. The issue is related to the use of '.' in the INC array.

Risk Assessment

This vulnerability could lead to unauthorized access to the system, posing a serious security threat to the organization. Local users may exploit this flaw to escalate privileges.

Recommendation

It is recommended to update the Config-Model library to version 2.102 or later to mitigate this vulnerability. Additionally, it is advisable to restrict access to working directories for local users.

Other vulnerabilities in Config-Model (libconfig-model-perl)

CVE-2017-0373High
The gen_class_pod implementation in lib/Config/Model/Utils/GenClassPod.pm in Config-Model before version 2.102 contains a dangerous 'use lib' line, allowing remote attackers to have an unspecified impact via a crafted Debian package file.

Original NVD description (English source)

lib/Config/Model.pm in Config-Model (aka libconfig-model-perl) before 2.102 allows local users to gain privileges via a crafted model in the current working directory, related to use of . with the INC array.