CVEvulnerability

CVE-2010-2761

4.3 MEDIUM Published 2010-12-06 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2010-12-06
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-94

Description

The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input that contains this value, a different vulnerability than CVE-2010-3172.

Affected configurations

• andy armstrong cgi.pm (<= 3.49) • andy armstrong cgi.pm 1.4 • andy armstrong cgi.pm 1.42 • andy armstrong cgi.pm 1.43 • andy armstrong cgi.pm 1.44 • andy armstrong cgi.pm 1.45 • andy armstrong cgi.pm 1.50 • andy armstrong cgi.pm 1.51 • andy armstrong cgi.pm 1.52 • andy armstrong cgi.pm 1.53 • andy armstrong cgi.pm 1.54 • andy armstrong cgi.pm 1.55 • andy armstrong cgi.pm 1.56 • andy armstrong cgi.pm 1.57 • andy armstrong cgi.pm 2.0 • andy armstrong cgi.pm 2.01 • andy armstrong cgi.pm 2.13 • andy armstrong cgi.pm 2.14 • andy armstrong cgi.pm 2.15 • andy armstrong cgi.pm 2.16 • andy armstrong cgi.pm 2.17 • andy armstrong cgi.pm 2.18 • andy armstrong cgi.pm 2.19 • andy armstrong cgi.pm 2.20 • andy armstrong cgi.pm 2.21 • andy armstrong cgi.pm 2.22 • andy armstrong cgi.pm 2.23 • andy armstrong cgi.pm 2.24 • andy armstrong cgi.pm 2.25 • andy armstrong cgi.pm 2.26 • andy armstrong cgi.pm 2.27 • andy armstrong cgi.pm 2.28 • andy armstrong cgi.pm 2.29 • andy armstrong cgi.pm 2.30 • andy armstrong cgi.pm 2.31 • andy armstrong cgi.pm 2.32 • andy armstrong cgi.pm 2.33 • andy armstrong cgi.pm 2.34 • andy armstrong cgi.pm 2.35 • andy armstrong cgi.pm 2.36 • andy armstrong cgi.pm 2.37 • andy armstrong cgi.pm 2.38 • andy armstrong cgi.pm 2.39 • andy armstrong cgi.pm 2.40 • andy armstrong cgi.pm 2.41 • andy armstrong cgi.pm 2.42 • andy armstrong cgi.pm 2.43 • andy armstrong cgi.pm 2.44 • andy armstrong cgi.pm 2.45 • andy armstrong cgi.pm 2.46 • andy armstrong cgi.pm 2.47 • andy armstrong cgi.pm 2.48 • andy armstrong cgi.pm 2.49 • andy armstrong cgi.pm 2.50 • andy armstrong cgi.pm 2.51 • andy armstrong cgi.pm 2.52 • andy armstrong cgi.pm 2.53 • andy armstrong cgi.pm 2.54 • andy armstrong cgi.pm 2.55 • andy armstrong cgi.pm 2.56 … and 114 more

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References