Vulnerability Details : CVE-2012-5526
CGI.pm module before 3.63 for Perl does not properly escape newlines in (1) Set-Cookie or (2) P3P headers, which might allow remote attackers to inject arbitrary headers into responses from applications that use CGI.pm.
Exploit prediction scoring system (EPSS) score for CVE-2012-5526
Probability of exploitation activity in the next 30 days: 0.79%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 79 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2012-5526
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2012-5526
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-5526
-
http://rhn.redhat.com/errata/RHSA-2013-0685.html
RHSA-2013:0685 - Security Advisory - Red Hat Customer Portal
-
http://www.debian.org/security/2012/dsa-2586
Debian -- Security Information -- DSA-2586-1 perl
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/80098
Perl CGI.pm header injection CVE-2012-5526 Vulnerability Report
-
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
Juniper Networks - 2015-10 Security Bulletin: CTPView: Multiple Vulnerabilities in CTPView
-
http://www.securityfocus.com/bid/56562
Perl CGI.pm 'Set-Cookie' and 'P3P' Headers HTTP Header Injection Vulnerability
-
http://cpansearch.perl.org/src/MARKSTOS/CGI.pm-3.63/Changes
-
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
Juniper Networks - 2016-04 Security Bulletin: CTP Series: Multiple vulnerabilities in CTP Series
-
http://www.ubuntu.com/usn/USN-1643-1
USN-1643-1: Perl vulnerabilities | Ubuntu security notices
-
http://www.securitytracker.com/id?1027780
Perl 'CGI.pm' Module Input Validation Flaw Lets Remote Users Inject Headers - SecurityTracker
-
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
Oracle VM Server for x86 Bulletin - July 2016
-
http://www.openwall.com/lists/oss-security/2012/11/15/6
oss-security - Re: CVE Request -- perl-CGI: Newline injection due to improper CRLF escaping in Set-Cookie and P3P headers
-
https://github.com/markstos/CGI.pm/pull/23
Page not found · GitHub · GitHub
Products affected by CVE-2012-5526
- cpe:2.3:a:andy_armstrong:cgi.pm:*:*:*:*:*:*:*:*