CVEvulnerability
CVE-2021-29662
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-03-31
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-704
Description
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
Affected configurations
• data\ \ validate\ (<= 0.29)
• netapp snapcenter
Related
Weakness · CWE (1)
- CWE-704 Incorrect Type Conversion or Cast weakness
Referenced by CWE · observed example (1)
- CWE-1389 Incorrect Parsing of Numbers with Different Radices weakness
References
- https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/ Exploit, Third Party Advisory
- https://github.com/houseabsolute/Data-Validate-IP Product, Third Party Advisory
- https://github.com/houseabsolute/Data-Validate-IP/commit/3bba13c819d616514a75e089badd75002fd4f14e Patch, Third Party Advisory
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-018.md Exploit, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210604-0002/ Third Party Advisory
- https://sick.codes/sick-2021-018/ Exploit, Third Party Advisory
- https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/ Exploit, Third Party Advisory
- https://github.com/houseabsolute/Data-Validate-IP Product, Third Party Advisory
- https://github.com/houseabsolute/Data-Validate-IP/commit/3bba13c819d616514a75e089badd75002fd4f14e Patch, Third Party Advisory
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-018.md Exploit, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210604-0002/ Third Party Advisory
- https://sick.codes/sick-2021-018/ Exploit, Third Party Advisory