CVE-2010-2761

CGI.pm < 3.50 - HTTP Response Splitting via Hardcoded MIME Boundary

Title source: manual
STIX 2.1

Description

The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input that contains this value, a different vulnerability than CVE-2010-3172.

References (35)

Core 35
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-1797.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053591.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43068
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2010/12/01/2
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/69588
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43165
Patch mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2010/12/01/3
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0212
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=591165
Issue Tracking x_refsource_confirm
http://www.bugzilla.org/security/3.2.9/
Issue Tracking x_refsource_misc
https://bugzilla.mozilla.org/show_bug.cgi?id=600464
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0271
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43033
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0207
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/42877
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0249
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:250
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:237
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/69589
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0076
Patch mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2010/12/01/1
Various Sources x_refsource_confirm
http://cpansearch.perl.org/src/LDS/CGI.pm-3.50/Changes
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053576.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43147

Scores

EPSS 0.0271
EPSS Percentile 84.2%

Details

CWE
CWE-94
Status published
Products (50)
andy_armstrong/cgi-simple 0.078
andy_armstrong/cgi-simple 0.079
andy_armstrong/cgi-simple 0.080
andy_armstrong/cgi-simple 0.081
andy_armstrong/cgi-simple 0.082
andy_armstrong/cgi-simple 0.83
andy_armstrong/cgi-simple 1.0
andy_armstrong/cgi-simple 1.1
andy_armstrong/cgi-simple 1.1.1
andy_armstrong/cgi-simple 1.1.2
... and 40 more
Published Dec 06, 2010
Tracked Since Feb 18, 2026