CVE-2011-10043 - Vulnerability Details - OpenCVE

Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Module names starting with "::" could be passed to the load function to specify arbitrary module paths. Attackers able to influence module names passed to load could use that bug to execute arbitrary code.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact total

No data.

No data.

No data.

No data.

References

Link	Providers
https://blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-or-bad-interfaces-make-good-people-do-bad-things.html
https://metacpan.org/release/BINGOS/Module-Load-0.22/changes
https://metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.20/lib/Module/Load.pm

History

Tue, 07 Jul 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 07 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Module names starting with "::" could be passed to the load function to specify arbitrary module paths. Attackers able to influence module names passed to load could use that bug to execute arbitrary code.
Title		Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded
Weaknesses		CWE-145
References		https://blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-or-bad-interfaces-make-good-people-do-bad-things.html https://metacpan.org/release/BINGOS/Module-Load-0.22/changes https://metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.20/lib/Module/Load.pm

MITRE

Status: PUBLISHED

Assigner: CPANSec

Published: 2026-07-07T11:46:13.575Z

Updated: 2026-07-07T16:04:29.197Z

Reserved: 2026-07-05T11:47:35.949Z

Link: CVE-2011-10043

Vulnrichment

Updated: 2026-07-07T16:04:03.424Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2011-10043", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-07-05T11:47:35.949Z", "datePublished": "2026-07-07T11:46:13.575Z", "dateUpdated": "2026-07-07T16:04:29.197Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Module-Load", "product": "Module::Load", "programFiles": ["lib/Module/Load.pm"], "programRoutines": [{"name": "Module::Load::_to_file"}], "repo": "https://github.com/jib/module-load", "vendor": "BINGOS", "versions": [{"lessThan": "0.22", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded.\n\nModule names starting with \"::\" could be passed to the load function to specify arbitrary module paths.\n\nAttackers able to influence module names passed to load could use that bug to execute arbitrary code."}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-145", "description": "CWE-145 Improper Neutralization of Section Delimiters", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-07T11:46:13.575Z"}, "references": [{"tags": ["technical-description"], "url": "https://blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-or-bad-interfaces-make-good-people-do-bad-things.html"}, {"url": "https://metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.20/lib/Module/Load.pm"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/BINGOS/Module-Load-0.22/changes"}], "solutions": [{"lang": "en", "value": "If you are using Perl v5.15.3 or earlier, then upgrade to Module::Load 0.22 or later.\n\nPerl versions after v5.15.4 include newer versions of Module::Load that fix this issue."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2011-10-02T00:00:00.000Z", "value": "General issue identified by Michael G Schwern in blog post."}, {"lang": "en", "time": "2011-10-04T00:00:00.000Z", "value": "Module::Load 0.22 released."}, {"lang": "en", "time": "2011-10-20T00:00:00.000Z", "value": "Perl v5.15.4 released with Module::Load 0.22."}], "title": "Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-07T16:04:25.108284Z", "id": "CVE-2011-10043", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-07T16:04:29.197Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2011-10043", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-07T16:04:25.108284Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-07T16:04:03.424Z"}}], "cna": {"title": "Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "affected": [{"repo": "https://github.com/jib/module-load", "vendor": "BINGOS", "product": "Module::Load", "versions": [{"status": "affected", "version": "0", "lessThan": "0.22", "versionType": "custom"}], "packageName": "Module-Load", "programFiles": ["lib/Module/Load.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Module::Load::_to_file"}]}], "timeline": [{"lang": "en", "time": "2011-10-02T00:00:00.000Z", "value": "General issue identified by Michael G Schwern in blog post."}, {"lang": "en", "time": "2011-10-04T00:00:00.000Z", "value": "Module::Load 0.22 released."}, {"lang": "en", "time": "2011-10-20T00:00:00.000Z", "value": "Perl v5.15.4 released with Module::Load 0.22."}], "solutions": [{"lang": "en", "value": "If you are using Perl v5.15.3 or earlier, then upgrade to Module::Load 0.22 or later.\n\nPerl versions after v5.15.4 include newer versions of Module::Load that fix this issue."}], "references": [{"url": "https://blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-or-bad-interfaces-make-good-people-do-bad-things.html", "tags": ["technical-description"]}, {"url": "https://metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.20/lib/Module/Load.pm"}, {"url": "https://metacpan.org/release/BINGOS/Module-Load-0.22/changes", "tags": ["release-notes"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded.\n\nModule names starting with \"::\" could be passed to the load function to specify arbitrary module paths.\n\nAttackers able to influence module names passed to load could use that bug to execute arbitrary code."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-145", "description": "CWE-145 Improper Neutralization of Section Delimiters"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-07T11:46:13.575Z"}}}, "cveMetadata": {"cveId": "CVE-2011-10043", "state": "PUBLISHED", "dateUpdated": "2026-07-07T16:04:29.197Z", "dateReserved": "2026-07-05T11:47:35.949Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-07-07T11:46:13.575Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}