Description
The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.
Remediation
References
Related Vulnerabilities
Grafana Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2020-12459)
WordPress Plugin ALO EasyMail Newsletter Cross-Site Scripting (2.8.1)
Oracle Database Server CVE-2005-4884 Vulnerability (CVE-2005-4884)
WordPress Plugin Sooqr Search Restricted File Upload (1.1.4)
phpMyAdmin Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2008-1924)