CVE-2023-31486

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2023/04/29/1Mailing List, Patch
http://www.openwall.com/lists/oss-security/2023/05/03/3Mailing List, Patch
http://www.openwall.com/lists/oss-security/2023/05/03/5Mailing List
http://www.openwall.com/lists/oss-security/2023/05/07/2Mailing List, Third Party Advisory
https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/Mitigation, Patch, Third Party Advisory
https://github.com/chansen/p5-http-tiny/pull/153Patch
https://hackeriet.github.io/cpan-http-tiny-overview/Product
https://www.openwall.com/lists/oss-security/2023/04/18/14Mailing List, Patch
https://www.openwall.com/lists/oss-security/2023/05/03/4Mailing List, Third Party Advisory
https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/Issue Tracking
http://www.openwall.com/lists/oss-security/2023/04/29/1Mailing List, Patch
http://www.openwall.com/lists/oss-security/2023/05/03/3Mailing List, Patch
http://www.openwall.com/lists/oss-security/2023/05/03/5Mailing List
http://www.openwall.com/lists/oss-security/2023/05/07/2Mailing List, Third Party Advisory
https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/Mitigation, Patch, Third Party Advisory
https://github.com/chansen/p5-http-tiny/pull/153Patch
https://hackeriet.github.io/cpan-http-tiny-overview/Product
https://security.netapp.com/advisory/ntap-20241129-0011/
https://www.openwall.com/lists/oss-security/2023/04/18/14Mailing List, Patch
https://www.openwall.com/lists/oss-security/2023/05/03/4Mailing List, Third Party Advisory
https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/Issue Tracking

Timeline

Published: Apr 29, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-314889.8Hyland Perceptive Filters releases before 2023-12-08 (e.g., 11.4.0.2647), as used in Cisco IronPort Email Security Appliance Software, Cisco CVE-2023-314895.5An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_capability_llgr() function.CVE-2023-31498.8A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been classified as critical. Affected is an unknown fun CVE-2023-314907.5An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_attr_psid_sub() function.CVE-2023-314926.5Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains CVE-2023-314936.6RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while exe CVE-2023-314977.8Incorrect access control in Quick Heal Technologies Limited Seqrite Endpoint Security (EPS) all versions prior to v8.0 allows attackers to e CVE-2023-314989.8A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to execute arbitrary code CVE-2023-31508.8A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been declared as critical. Affected by this vulnerabili CVE-2023-315027.2Altenergy Power Control Software C1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the component /models/mana CVE-2023-315057.2An arbitrary file upload vulnerability in Schlix CMS v2.2.8-1, allows remote authenticated attackers to execute arbitrary code and obtain se CVE-2023-315065.4A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary we