Lucene search
MitreCVE-2010-4411HistoryDec 06, 2010 - 8:13 p.m.
CVE-2010-4411
2010-12-0620:13:00
mitre
web.nvd.nist.gov
40
cgi.pm
vulnerability
http headers
http response splitting
cve-2010-4411
cve-2010-2761
nvd
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
AI Score
9.1
Confidence
High
EPSS
0.008
Percentile
81.8%
Unspecified vulnerability in CGI.pm 3.50 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unknown vectors. NOTE: this issue exists because of an incomplete fix for CVE-2010-2761.
Affected configurations
Node
andy_armstrongcgi.pmRange≤3.50
ORandy_armstrongcgi.pmMatch1.4
ORandy_armstrongcgi.pmMatch1.42
ORandy_armstrongcgi.pmMatch1.43
ORandy_armstrongcgi.pmMatch1.44
ORandy_armstrongcgi.pmMatch1.45
ORandy_armstrongcgi.pmMatch1.50
ORandy_armstrongcgi.pmMatch1.51
ORandy_armstrongcgi.pmMatch1.52
ORandy_armstrongcgi.pmMatch1.53
ORandy_armstrongcgi.pmMatch1.54
ORandy_armstrongcgi.pmMatch1.55
ORandy_armstrongcgi.pmMatch1.56
ORandy_armstrongcgi.pmMatch1.57
ORandy_armstrongcgi.pmMatch2.0
ORandy_armstrongcgi.pmMatch2.01
ORandy_armstrongcgi.pmMatch2.13
ORandy_armstrongcgi.pmMatch2.14
ORandy_armstrongcgi.pmMatch2.15
ORandy_armstrongcgi.pmMatch2.16
ORandy_armstrongcgi.pmMatch2.17
ORandy_armstrongcgi.pmMatch2.18
ORandy_armstrongcgi.pmMatch2.19
ORandy_armstrongcgi.pmMatch2.20
ORandy_armstrongcgi.pmMatch2.21
ORandy_armstrongcgi.pmMatch2.22
ORandy_armstrongcgi.pmMatch2.23
ORandy_armstrongcgi.pmMatch2.24
ORandy_armstrongcgi.pmMatch2.25
ORandy_armstrongcgi.pmMatch2.26
ORandy_armstrongcgi.pmMatch2.27
ORandy_armstrongcgi.pmMatch2.28
ORandy_armstrongcgi.pmMatch2.29
ORandy_armstrongcgi.pmMatch2.30
ORandy_armstrongcgi.pmMatch2.31
ORandy_armstrongcgi.pmMatch2.32
ORandy_armstrongcgi.pmMatch2.33
ORandy_armstrongcgi.pmMatch2.34
ORandy_armstrongcgi.pmMatch2.35
ORandy_armstrongcgi.pmMatch2.36
ORandy_armstrongcgi.pmMatch2.37
ORandy_armstrongcgi.pmMatch2.38
ORandy_armstrongcgi.pmMatch2.39
ORandy_armstrongcgi.pmMatch2.40
ORandy_armstrongcgi.pmMatch2.41
ORandy_armstrongcgi.pmMatch2.42
ORandy_armstrongcgi.pmMatch2.43
ORandy_armstrongcgi.pmMatch2.44
ORandy_armstrongcgi.pmMatch2.45
ORandy_armstrongcgi.pmMatch2.46
ORandy_armstrongcgi.pmMatch2.47
ORandy_armstrongcgi.pmMatch2.48
ORandy_armstrongcgi.pmMatch2.49
ORandy_armstrongcgi.pmMatch2.50
ORandy_armstrongcgi.pmMatch2.51
ORandy_armstrongcgi.pmMatch2.52
ORandy_armstrongcgi.pmMatch2.53
ORandy_armstrongcgi.pmMatch2.54
ORandy_armstrongcgi.pmMatch2.55
ORandy_armstrongcgi.pmMatch2.56
ORandy_armstrongcgi.pmMatch2.57
ORandy_armstrongcgi.pmMatch2.58
ORandy_armstrongcgi.pmMatch2.59
ORandy_armstrongcgi.pmMatch2.60
ORandy_armstrongcgi.pmMatch2.61
ORandy_armstrongcgi.pmMatch2.62
ORandy_armstrongcgi.pmMatch2.63
ORandy_armstrongcgi.pmMatch2.64
ORandy_armstrongcgi.pmMatch2.65
ORandy_armstrongcgi.pmMatch2.66
ORandy_armstrongcgi.pmMatch2.67
ORandy_armstrongcgi.pmMatch2.68
ORandy_armstrongcgi.pmMatch2.69
ORandy_armstrongcgi.pmMatch2.70
ORandy_armstrongcgi.pmMatch2.71
ORandy_armstrongcgi.pmMatch2.72
ORandy_armstrongcgi.pmMatch2.73
ORandy_armstrongcgi.pmMatch2.74
ORandy_armstrongcgi.pmMatch2.75
ORandy_armstrongcgi.pmMatch2.76
ORandy_armstrongcgi.pmMatch2.77
ORandy_armstrongcgi.pmMatch2.78
ORandy_armstrongcgi.pmMatch2.79
ORandy_armstrongcgi.pmMatch2.80
ORandy_armstrongcgi.pmMatch2.81
ORandy_armstrongcgi.pmMatch2.82
ORandy_armstrongcgi.pmMatch2.83
ORandy_armstrongcgi.pmMatch2.84
ORandy_armstrongcgi.pmMatch2.85
ORandy_armstrongcgi.pmMatch2.86
ORandy_armstrongcgi.pmMatch2.87
ORandy_armstrongcgi.pmMatch2.88
ORandy_armstrongcgi.pmMatch2.89
ORandy_armstrongcgi.pmMatch2.90
ORandy_armstrongcgi.pmMatch2.91
ORandy_armstrongcgi.pmMatch2.92
ORandy_armstrongcgi.pmMatch2.93
ORandy_armstrongcgi.pmMatch2.94
ORandy_armstrongcgi.pmMatch2.95
ORandy_armstrongcgi.pmMatch2.96
ORandy_armstrongcgi.pmMatch2.97
ORandy_armstrongcgi.pmMatch2.98
ORandy_armstrongcgi.pmMatch2.99
ORandy_armstrongcgi.pmMatch2.751
ORandy_armstrongcgi.pmMatch2.752
ORandy_armstrongcgi.pmMatch3.00
ORandy_armstrongcgi.pmMatch3.01
ORandy_armstrongcgi.pmMatch3.02
ORandy_armstrongcgi.pmMatch3.03
ORandy_armstrongcgi.pmMatch3.04
ORandy_armstrongcgi.pmMatch3.05
ORandy_armstrongcgi.pmMatch3.06
ORandy_armstrongcgi.pmMatch3.07
ORandy_armstrongcgi.pmMatch3.08
ORandy_armstrongcgi.pmMatch3.09
ORandy_armstrongcgi.pmMatch3.10
ORandy_armstrongcgi.pmMatch3.11
ORandy_armstrongcgi.pmMatch3.12
ORandy_armstrongcgi.pmMatch3.13
ORandy_armstrongcgi.pmMatch3.14
ORandy_armstrongcgi.pmMatch3.15
ORandy_armstrongcgi.pmMatch3.16
ORandy_armstrongcgi.pmMatch3.17
ORandy_armstrongcgi.pmMatch3.18
ORandy_armstrongcgi.pmMatch3.19
ORandy_armstrongcgi.pmMatch3.20
ORandy_armstrongcgi.pmMatch3.21
ORandy_armstrongcgi.pmMatch3.22
ORandy_armstrongcgi.pmMatch3.23
ORandy_armstrongcgi.pmMatch3.24
ORandy_armstrongcgi.pmMatch3.25
ORandy_armstrongcgi.pmMatch3.26
ORandy_armstrongcgi.pmMatch3.27
ORandy_armstrongcgi.pmMatch3.28
ORandy_armstrongcgi.pmMatch3.29
ORandy_armstrongcgi.pmMatch3.30
ORandy_armstrongcgi.pmMatch3.31
ORandy_armstrongcgi.pmMatch3.32
ORandy_armstrongcgi.pmMatch3.33
ORandy_armstrongcgi.pmMatch3.34
ORandy_armstrongcgi.pmMatch3.35
ORandy_armstrongcgi.pmMatch3.36
ORandy_armstrongcgi.pmMatch3.37
ORandy_armstrongcgi.pmMatch3.38
ORandy_armstrongcgi.pmMatch3.39
ORandy_armstrongcgi.pmMatch3.40
ORandy_armstrongcgi.pmMatch3.41
ORandy_armstrongcgi.pmMatch3.42
ORandy_armstrongcgi.pmMatch3.43
ORandy_armstrongcgi.pmMatch3.44
ORandy_armstrongcgi.pmMatch3.45
ORandy_armstrongcgi.pmMatch3.46
ORandy_armstrongcgi.pmMatch3.47
ORandy_armstrongcgi.pmMatch3.48
ORandy_armstrongcgi.pmMatch3.49
| Vendor | Product | Version | CPE |
|---|---|---|---|
| andy_armstrong | cgi.pm | 2.65 | cpe:/a:andy_armstrong:cgi.pm:2.65::: |
| andy_armstrong | cgi.pm | 2.22 | cpe:/a:andy_armstrong:cgi.pm:2.22::: |
| andy_armstrong | cgi.pm | 2.99 | cpe:/a:andy_armstrong:cgi.pm:2.99::: |
| andy_armstrong | cgi.pm | 2.29 | cpe:/a:andy_armstrong:cgi.pm:2.29::: |
| andy_armstrong | cgi.pm | 3.25 | cpe:/a:andy_armstrong:cgi.pm:3.25::: |
| andy_armstrong | cgi.pm | 2.24 | cpe:/a:andy_armstrong:cgi.pm:2.24::: |
| andy_armstrong | cgi.pm | 2.54 | cpe:/a:andy_armstrong:cgi.pm:2.54::: |
| andy_armstrong | cgi.pm | 2.01 | cpe:/a:andy_armstrong:cgi.pm:2.01::: |
| andy_armstrong | cgi.pm | 2.38 | cpe:/a:andy_armstrong:cgi.pm:2.38::: |
| andy_armstrong | cgi.pm | 2.18 | cpe:/a:andy_armstrong:cgi.pm:2.18::: |
References
lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html
lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html
lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
openwall.com/lists/oss-security/2010/12/01/3
secunia.com/advisories/43033
secunia.com/advisories/43068
secunia.com/advisories/43165
www.bugzilla.org/security/3.2.9/
www.mandriva.com/security/advisories?name=MDVSA-2011:008
www.vupen.com/english/advisories/2011/0106
www.vupen.com/english/advisories/2011/0207
www.vupen.com/english/advisories/2011/0212
www.vupen.com/english/advisories/2011/0271
bugzilla.mozilla.org/show_bug.cgi?id=591165
Related
cvelist
cvelist
debiancve
debiancve
openvas
openvas
Mandriva Update for perl-CGI MDVSA-2011:008 (perl-CGI)
2011-01-21 00:00:00
Mandriva Update for perl-CGI MDVSA-2011:008 (perl-CGI)
2011-01-21 00:00:00
Fedora Update for perl-CGI-Simple FEDORA-2011-0631
2011-01-31 00:00:00
nessus
nessus
Solaris 10 (x86) : 141553-04
2018-03-12 00:00:00
Solaris 10 (sparc) : 141552-04
2018-03-12 00:00:00
Mandriva Linux Security Advisory : perl-CGI (MDVSA-2011:008)
2011-01-28 00:00:00
ubuntucve
ubuntucve
nvd
nvd
prion
prion
Design/Logic Flaw
2010-12-06 20:13:00
Crlf injection
2011-01-28 16:00:00
Hardcoded credentials
2010-12-06 20:12:00
fedora
fedora
[SECURITY] Fedora 14 Update: perl-CGI-Simple-1.113-1.fc14
2011-01-30 19:52:02
[SECURITY] Fedora 13 Update: perl-CGI-Simple-1.113-1.fc13
2011-01-30 19:48:24
[SECURITY] Fedora 13 Update: perl-CGI-3.51-1.fc13
2011-01-31 19:51:59
cve
cve
altlinux
altlinux
Security fix for the ALT Linux 6 package perl-CGI version 3.49-alt2
2011-01-19 00:00:00
securityvulns
securityvulns
[USN-1129-1] Perl vulnerabilities
2011-05-05 00:00:00
perl multiple security vulnerabilities
2011-05-20 00:00:00
[ MDVSA-2010:250 ] perl-CGI-Simple
2010-12-12 00:00:00
ubuntu
ubuntu
Perl vulnerabilities
2011-05-03 00:00:00
freebsd
freebsd
bugzilla -- multiple serious vulnerabilities
2011-01-24 00:00:00
veracode
veracode
HTTP Response Splitting
2020-04-10 00:59:28
f5
f5
redhat
redhat
(RHSA-2011:1797) Moderate: perl security update
2011-12-08 00:00:00
(RHSA-2011:0558) Moderate: perl security and bug fix update
2011-05-19 00:00:00
oraclelinux
oraclelinux
perl security update
2011-12-08 00:00:00
perl security and bug fix update
2011-05-28 00:00:00
centos
centos
perl security update
2011-12-09 08:14:32
gentoo
gentoo
Bugzilla: Multiple vulnerabilities
2011-10-10 00:00:00
vmware
vmware
VMware vSphere and vCOps updates to third party libraries
2012-08-30 00:00:00
VMware vSphere and vCOps updates to third party libraries
2012-08-30 00:00:00
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
AI Score
9.1
Confidence
High
EPSS
0.008
Percentile
81.8%
Related for CVE-2010-4411