CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.62.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
CallBackery, a Perl application, is affected in versions before 0.62.0. An unauthenticated attacker can include newline characters in a login name, which lets them insert fake entries into the application log, such as a made-up successful administrator login.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record format adds a forged record. An unauthenticated attacker can forge log records, such as a successful administrator login from an address of their choosing.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- CallBackery
fixed in 0.62.0