PT-2020-6752 · Dbi+6 · Dbi+6

Published 2020-09-16 · Updated 2025-08-26 · CVE-2014-10402

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions DBI module through 1.643 for Perl

Description The issue is related to the DBI module for Perl, where the DBD::File drivers can open files from folders other than those specifically passed via the f dir attribute in the data source name (DSN). This is due to an incomplete fix for a previous issue. Exploitation of this issue can allow an attacker to access confidential data and cause a denial of service.

Recommendations For DBI module through 1.643 for Perl, consider restricting access to sensitive files and folders to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the f dir attribute in the DSN to prevent unauthorized file access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

ALT-PU-2022-3385

AZL-41925

BDU:2022-05974

CVE-2014-10402

DLA-3035-1

MGASA-2021-0451

OESA-2022-1641

OPENSUSE-SU-2020:2051-1

OPENSUSE-SU-2020:2064-1

OPENSUSE-SU-2020_2051-1

OPENSUSE-SU-2020_2064-1

OPENSUSE-SU-2024:11161-1

SUSE-SU-2020:3384-1

SUSE-SU-2020:3385-1

SUSE-SU-2024:3136-1

USN-5030-1

USN-5030-2

Affected Products

Alt Linux

Astra Linux

Dbi

Linuxmint

Red Os

Suse

Ubuntu

References · 47

• 🔥 https://rt.cpan.org/Public/Bug/Display.html?id=99508#txn-1911590 · Exploit
• https://osv.dev/vulnerability/USN-5030-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0451.html · Security Note
• https://ubuntu.com/security/notices/USN-5030-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1641 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-10402 · Security Note
• https://osv.dev/vulnerability/AZL-41925 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-10402 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-10402 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14393 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:3136-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:2064-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:3385-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:2051-1 · Vendor Advisory