The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the…

Description

The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input that contains this value, a different vulnerability than CVE-2010-3172.

Scores

EPSS (exploitation in 30 days)

2.7% · top 14% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

• n/a
• CWE-94 (opens in a new tab)All about CWE-94 and its CVEs

Affected products

• n/a

  • affected n/a

References (35)

• http://perl5.git.perl.org/perl.git/blobdiff/a0b94c2432b1d8c20653453a0f6970cb10f59aec..84601d63a7e34958da47dad1e61e27cb3bd467d1:/cpan/CGI/lib/CGI.pm (opens in a new tab)x_refsource_CONFIRMx_transferred
• RHSA-2011:1797 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• SUSE-SR:2011:001 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• FEDORA-2011-0653 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• 43068 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• [oss-security] 20101201 Re: CVE Request -- perl-CGI two ids, perl-CGI-Simple one id (CVE-2010-3172 already assigned for Bugzilla part) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• 69588 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 43165 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• [oss-security] 20101201 Re: CVE Request -- perl-CGI two ids, perl-CGI-Simple one id (CVE-2010-3172 already assigned for Bugzilla part) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• ADV-2011-0212 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• https://bugzilla.mozilla.org/show_bug.cgi?id=591165 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://github.com/AndyA/CGI--Simple/commit/e4942b871a26c1317a175a91ebb7262eea59b380 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.bugzilla.org/security/3.2.9/ (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://bugzilla.mozilla.org/show_bug.cgi?id=600464 (opens in a new tab)x_refsource_MISCx_transferred
• FEDORA-2011-0741 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• SUSE-SR:2011:005 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• ADV-2011-0271 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 43033 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2011-0207 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 42877 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• SUSE-SR:2011:002 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• http://perl5.git.perl.org/perl.git/commit/84601d63a7e34958da47dad1e61e27cb3bd467d1 (opens in a new tab)x_refsource_CONFIRMx_transferred
• ADV-2011-0249 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• FEDORA-2011-0755 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• MDVSA-2010:250 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• http://www.nntp.perl.org/group/perl.perl5.changes/2010/11/msg28043.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• MDVSA-2010:237 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• 69589 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• ADV-2011-0076 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• [oss-security] 20101201 CVE Request -- perl-CGI two ids, perl-CGI-Simple one id (CVE-2010-3172 already assigned for Bugzilla part) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• http://cpansearch.perl.org/src/LDS/CGI.pm-3.50/Changes (opens in a new tab)x_refsource_CONFIRMx_transferred
• FEDORA-2011-0631 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 43147 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735 (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2010-2761](https://trackcve.app/badge/CVE-2010-2761.svg)](https://trackcve.app/cve/CVE-2010-2761)

Record last updated 7 Aug 2024, 02:46 UTC.