CVSS: 4.3EPSS: 0%CPEs: 174EXPL: 0CVE-2010-4410 – perl-CGI-Simple: - hardcoded MIME boundary value for multipart content, CVE-2010-4410 - CRLF injection allowing HTTP response splitting
https://notcve.org/view.php?id=CVE-2010-4410
CRLF injection vulnerability in the header function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors related to non-whitespace characters preceded by newline characters, a different vulnerability than CVE-2010-2761 and CVE-2010-3172. Vulnerabilidad de inyección CRLF (se refiere a CR (retorno de carro) y LF (salto de línea)) en la función header de (1) CGI.pm en versiones anteriores a la 3.50 y (2) Simple.pm de CGI::Simple 1.112 y versiones anteriores. Permite a atacantes remotos inyectar cabeceras HTTP y realizar un ataque de división de respuesta HTTP a través de vectores relacionados con caracteres que no son espacios en blanco precididos por caracteres de nueva línea. Una vulnerabilidad distinta a CVE-2010-2761 y CVE-2010-3172. • http://cpansearch.perl.org/src/LDS/CGI.pm-3.50/Changes http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735 http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053576.html http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053591.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html http: • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.3EPSS: 0%CPEs: 174EXPL: 0CVE-2010-2761 – perl-CGI-Simple: - hardcoded MIME boundary value for multipart content, CVE-2010-4410 - CRLF injection allowing HTTP response splitting
https://notcve.org/view.php?id=CVE-2010-2761
The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input that contains this value, a different vulnerability than CVE-2010-3172. La función multipart_init de (1) CGI.pm en versiones anteriores a la 3.50 y (2) Simple.pm de CGI::Simple 1.112 y versiones anteriores usa un valor estático ("hardcoded") en la cadena de límite MIME en el contenido multipart/x-mixed-replace. Lo que permite a atacantes remotos inyectar cabeceras HTTP de su elección y realizar ataques de división de respuestas HTTP a través de una entrada modificada que contiene este valor. Una vulnerabilidad distinta a la CVE-2010-3172. • http://cpansearch.perl.org/src/LDS/CGI.pm-3.50/Changes http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735 http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053576.html http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053591 • CWE-94: Improper Control of Generation of Code ('Code Injection') •