Apache Mod Perl vulnerabilities

3 CVEs affecting Apache Mod Perl, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2011-2767, published 2018-08-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2009-0796, published 2009-04-07. Low severity, CVSS 2.6. EPSS: 29.6% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Status.pm in Apache::Status and Apache2::Status in mod_perl1 and mod_perl2 for the Apache HTTP Server, when /perl-status is accessible, allows remote…
CVE-2007-1349, published 2007-03-30. Medium severity, CVSS 5.0. EPSS: 10.1% chance of exploitation in the next 30 days. PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a…
CVE-2011-2767, published 2018-08-26. Critical severity, CVSS 9.8. EPSS: 8.9% chance of exploitation in the next 30 days. mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that…