CVE-2010-2761
Summary
| CVE | CVE-2010-2761 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2010-12-06 20:12:58 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input that contains this value, a different vulnerability than CVE-2010-3172. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Andy Armstrong | Cgi-simple | 0.078 | All | All | All |
| Application | Andy Armstrong | Cgi-simple | 0.079 | All | All | All |
| Application | Andy Armstrong | Cgi-simple | 0.080 | All | All | All |
| Application | Andy Armstrong | Cgi-simple | 0.081 | All | All | All |
| Application | Andy Armstrong | Cgi-simple | 0.082 | All | All | All |
| Application | Andy Armstrong | Cgi-simple | 0.83 | All | All | All |
| Application | Andy Armstrong | Cgi-simple | 1.0 | All | All | All |
| Application | Andy Armstrong | Cgi-simple | 1.1 | All | All | All |
| Application | Andy Armstrong | Cgi-simple | 1.1.1 | All | All | All |
| Application | Andy Armstrong | Cgi-simple | 1.1.2 | All | All | All |
| Application | Andy Armstrong | Cgi-simple | 1.103 | All | All | All |
| Application | Andy Armstrong | Cgi-simple | 1.104 | All | All | All |
| Application | Andy Armstrong | Cgi-simple | 1.105 | All | All | All |
| Application | Andy Armstrong | Cgi-simple | 1.106 | All | All | All |
| Application | Andy Armstrong | Cgi-simple | 1.107 | All | All | All |
| Application | Andy Armstrong | Cgi-simple | 1.108 | All | All | All |
| Application | Andy Armstrong | Cgi-simple | 1.109 | All | All | All |
| Application | Andy Armstrong | Cgi-simple | 1.110 | All | All | All |
| Application | Andy Armstrong | Cgi-simple | 1.111 | All | All | All |
| Application | Andy Armstrong | Cgi-simple | All | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 1.4 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 1.42 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 1.43 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 1.44 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 1.45 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 1.50 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 1.51 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 1.52 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 1.53 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 1.54 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 1.55 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 1.56 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 1.57 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.0 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.01 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.13 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.14 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.15 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.16 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.17 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.18 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.19 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.20 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.21 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.22 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.23 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.24 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.25 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.26 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.27 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.28 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.29 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.30 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.31 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.32 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.33 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.34 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.35 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.36 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.37 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.38 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.39 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.40 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.41 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.42 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.43 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.44 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.45 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.46 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.47 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.48 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.49 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.50 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.51 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.52 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.53 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.54 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.55 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.56 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.57 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.58 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.59 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.60 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.61 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.62 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.63 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.64 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.65 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.66 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.67 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.68 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.69 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.70 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.71 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.72 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.73 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.74 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.75 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.751 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.752 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.76 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.77 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.78 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.79 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.80 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.81 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.82 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.83 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.84 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.85 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.86 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.87 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.88 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.89 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.90 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.91 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.92 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.93 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.94 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.95 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.96 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.97 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.98 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 2.99 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.00 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.01 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.02 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.03 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.04 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.05 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.06 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.07 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.08 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.09 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.10 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.11 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.12 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.13 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.14 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.15 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.16 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.17 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.18 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.19 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.20 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.21 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.22 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.23 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.24 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.25 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.26 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.27 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.28 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.29 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.30 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.31 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.32 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.33 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.34 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.35 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.36 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.37 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.38 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.39 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.40 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.41 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.42 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.43 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.44 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.45 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.46 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.47 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | 3.48 | All | All | All |
| Application | Andy Armstrong | Cgi.pm | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| 600464 – (CVE-2010-3172) [SECURITY] Content/Header injection due to non-random multipart/x-mixed-replace boundary | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.mozilla.org | |
| Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| SUSE update for Multiple Packages - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| oss-security - CVE Request -- perl-CGI two ids, perl-CGI-Simple one id (CVE-2010-3172 already assigned for Bugzilla part) | af854a3a-2127-422b-91ae-364da2661108 | openwall.com | Patch |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| [SECURITY] Fedora 13 Update: perl-CGI-Simple-1.113-1.fc13 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| SUSE update for multiple packages - Advisories - Community | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Support / Security / Advisories / / MDVSA-2010:237 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| oss-security - Re: CVE Request -- perl-CGI two ids, perl-CGI-Simple one id (CVE-2010-3172 already assigned for Bugzilla part) | af854a3a-2127-422b-91ae-364da2661108 | openwall.com | |
| [security-announce] SUSE Security Summary Report: SUSE-SR:2011:002 | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| Support / Security / Advisories / / MDVSA-2010:250 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Fedora update for bugzilla - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| [SECURITY] Fedora 13 Update: bugzilla-3.4.10-1.fc13 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Fedora update for perl-CGI-Simple - Advisories - Community | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| cpansearch.perl.org/src/LDS/CGI.pm-3.50/Changes | af854a3a-2127-422b-91ae-364da2661108 | cpansearch.perl.org | |
| [SECURITY] Fedora 14 Update: bugzilla-3.6.4-1.fc14 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [security-announce] SUSE Security Summary Report: SUSE-SR:2011:005 | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| osvdb.org/69589 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | |
| osvdb.org/69588 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | |
| perl5.git.perl.org Git - perl.git/commit | af854a3a-2127-422b-91ae-364da2661108 | perl5.git.perl.org | Patch |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| perl5.git.perl.org Git - perl.git/blobdiff - cpan/CGI/lib/CGI.pm | af854a3a-2127-422b-91ae-364da2661108 | perl5.git.perl.org | Patch |
| oss-security - Re: CVE Request -- perl-CGI two ids, perl-CGI-Simple one id (CVE-2010-3172 already assigned for Bugzilla part) | af854a3a-2127-422b-91ae-364da2661108 | openwall.com | Patch |
| Juniper Networks - 2015-10 Security Bulletin: CTPView: Multiple Vulnerabilities in CTPView | af854a3a-2127-422b-91ae-364da2661108 | kb.juniper.net | |
| 2016-04 Security Bulletin: CTP Series: Multiple vulnerabilities in CTP Series - Juniper Networks | af854a3a-2127-422b-91ae-364da2661108 | kb.juniper.net | |
| [SECURITY] Fedora 14 Update: perl-CGI-Simple-1.113-1.fc14 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| 3.2.9, 3.4.9, 3.6.3, and and 4.0rc1 Security Advisory :: Bugzilla :: bugzilla.org | af854a3a-2127-422b-91ae-364da2661108 | www.bugzilla.org | |
| Randomise multipart boundary. Thanks to Yamada Masahiro. · AndyA/CGI--Simple@e4942b8 · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Patch |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| [perl.git] branch blead, updated. v5.13.6-439-g84601d6 - nntp.perl.org | af854a3a-2127-422b-91ae-364da2661108 | www.nntp.perl.org | Patch |
| [security-announce] SUSE Security Summary Report: SUSE-SR:2011:001 | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| Bugzilla Multiple Vulnerabilities - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| 591165 – (CVE-2010-2761) [SECURITY] Header injection, cross-site scripting in report.cgi | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.mozilla.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.