CVE-2010-4410

CGI.pm < 3.50 - HTTP Response Splitting via Header Function

Title source: llm
STIX 2.1

Description

CRLF injection vulnerability in the header function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors related to non-whitespace characters preceded by newline characters, a different vulnerability than CVE-2010-2761 and CVE-2010-3172.

References (24)

Core 24
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-1797.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43068
Patch mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2010/12/01/2
Patch mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2010/12/01/3
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=658970
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053591.html
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0212
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:252
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/44199
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/3230
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0249
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/45145
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:237
Patch mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2010/12/01/1
Various Sources x_refsource_confirm
http://cpansearch.perl.org/src/LDS/CGI.pm-3.50/Changes
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053576.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43147

Scores

EPSS 0.0204
EPSS Percentile 78.8%

Details

CWE
CWE-94
Status published
Products (50)
andy_armstrong/cgi-simple 0.078
andy_armstrong/cgi-simple 0.079
andy_armstrong/cgi-simple 0.080
andy_armstrong/cgi-simple 0.081
andy_armstrong/cgi-simple 0.082
andy_armstrong/cgi-simple 0.83
andy_armstrong/cgi-simple 1.0
andy_armstrong/cgi-simple 1.1
andy_armstrong/cgi-simple 1.1.1
andy_armstrong/cgi-simple 1.1.2
... and 40 more
Published Dec 06, 2010
Tracked Since Feb 18, 2026