194 lines
9.8 KiB
JSON
194 lines
9.8 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2025-40927",
|
||
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "CPANSec",
|
||
"dateReserved": "2025-04-16T09:05:34.362Z",
|
||
"datePublished": "2025-08-29T00:10:07.161Z",
|
||
"dateUpdated": "2025-08-29T13:18:32.704Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"collectionURL": "https://cpan.org/modules",
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "CGI-Simple",
|
||
"product": "CGI::Simple",
|
||
"programFiles": [
|
||
"lib/CGI/Simple.pm"
|
||
],
|
||
"repo": "https://github.com/manwar/CGI--Simple",
|
||
"vendor": "MANWAR",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.282",
|
||
"status": "affected",
|
||
"version": "0",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"type": "finder",
|
||
"value": "Maxim Kosenko"
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw<br><p>This vulnerability is a <strong>confirmed HTTP response splitting</strong> flaw in <code>CGI::Simple</code> <span style=\"background-color: rgb(255, 255, 255);\">that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions</span>.</p><p>Although some validation exists, it can be bypassed using URL-encoded values, allowing an attacker to inject untrusted content into the response via query parameters.</p><p></p><p>As a result, an attacker can inject a line break (e.g. <code>%0A</code>) into the parameter value, causing the server to split the HTTP response and inject arbitrary headers or even an HTML/JavaScript body, leading to reflected cross-site scripting (XSS), open redirect or other attacks.</p><p>The issue documented in <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.cve.org/CVERecord?id=CVE-2010-4410\">CVE-2010-4410</a><span style=\"background-color: rgb(255, 255, 255);\"> is related but the fix was incomplete.</span> </p><p><strong>Impact</strong></p><p>By injecting <code>%0A</code> (newline) into a query string parameter, an attacker can:</p><ol><li>Break the current HTTP header</li><li>Inject a new header or entire body</li><li>Deliver a script payload that is reflected in the server’s response</li></ol><p>That can lead to the following attacks:</p><ul><li>reflected XSS</li><li>open redirect</li><li>cache poisoning</li><li>header manipulation</li></ul><br>"
|
||
}
|
||
],
|
||
"value": "CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw\nThis vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions.\n\nAlthough some validation exists, it can be bypassed using URL-encoded values, allowing an attacker to inject untrusted content into the response via query parameters.\n\n\n\nAs a result, an attacker can inject a line break (e.g. %0A) into the parameter value, causing the server to split the HTTP response and inject arbitrary headers or even an HTML/JavaScript body, leading to reflected cross-site scripting (XSS), open redirect or other attacks.\n\nThe issue documented in CVE-2010-4410 https://www.cve.org/CVERecord?id=CVE-2010-4410 is related but the fix was incomplete.\n\nImpact\n\nBy injecting %0A (newline) into a query string parameter, an attacker can:\n\n * Break the current HTTP header\n * Inject a new header or entire body\n * Deliver a script payload that is reflected in the server’s response\nThat can lead to the following attacks:\n\n * reflected XSS\n * open redirect\n * cache poisoning\n * header manipulation"
|
||
}
|
||
],
|
||
"impacts": [
|
||
{
|
||
"capecId": "CAPEC-34",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "CAPEC-34 HTTP Response Splitting"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-113",
|
||
"description": "CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
|
||
"shortName": "CPANSec",
|
||
"dateUpdated": "2025-08-29T00:10:07.161Z"
|
||
},
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"related"
|
||
],
|
||
"url": "https://metacpan.org/release/MANWAR/CGI-Simple-1.281/source/lib/CGI/Simple.pm#L1031-1035"
|
||
},
|
||
{
|
||
"tags": [
|
||
"related"
|
||
],
|
||
"url": "https://metacpan.org/release/MANWAR/CGI-Simple-1.281/diff/MANWAR/CGI-Simple-1.282/lib/CGI/Simple.pm"
|
||
},
|
||
{
|
||
"tags": [
|
||
"technical-description"
|
||
],
|
||
"url": "https://owasp.org/www-community/attacks/HTTP_Response_Splitting"
|
||
},
|
||
{
|
||
"tags": [
|
||
"technical-description"
|
||
],
|
||
"url": "https://datatracker.ietf.org/doc/html/rfc7230#section-3"
|
||
},
|
||
{
|
||
"tags": [
|
||
"related"
|
||
],
|
||
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2320"
|
||
},
|
||
{
|
||
"tags": [
|
||
"related"
|
||
],
|
||
"url": "https://rt.perl.org/Public/Bug/Display.html?id=21951"
|
||
}
|
||
],
|
||
"solutions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "Upgrade CGI::Simple to version 1.282 or higher"
|
||
}
|
||
],
|
||
"value": "Upgrade CGI::Simple to version 1.282 or higher"
|
||
}
|
||
],
|
||
"source": {
|
||
"discovery": "EXTERNAL"
|
||
},
|
||
"title": "CGI::Simple versions 1.281 and earlier for Perl has a HTTP response splitting flaw",
|
||
"x_generator": {
|
||
"engine": "Vulnogram 0.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"scope": "UNCHANGED",
|
||
"version": "3.1",
|
||
"baseScore": 7.3,
|
||
"attackVector": "NETWORK",
|
||
"baseSeverity": "HIGH",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
||
"integrityImpact": "LOW",
|
||
"userInteraction": "NONE",
|
||
"attackComplexity": "LOW",
|
||
"availabilityImpact": "LOW",
|
||
"privilegesRequired": "NONE",
|
||
"confidentialityImpact": "LOW"
|
||
}
|
||
},
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2025-08-29T13:18:01.758812Z",
|
||
"id": "CVE-2025-40927",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2025-08-29T13:18:32.704Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |