2 lines
1.6 KiB
JSON
2 lines
1.6 KiB
JSON
{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["Plack::Middleware::CSP"],"packageName":"Plack-Middleware-CSP","packageURL":"pkg:cpan/Plack-Middleware-CSP","programFiles":["lib/Plack/Middleware/CSP.pm"],"programRoutines":[{"name":"Plack::Middleware::CSP::call"}],"repo":"https://github.com/pangyre/Plack-Middleware-CSP/","versions":[{"lessThan":"0.03","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it.\n\nThe call method sets the policy in a response header named \"content-security-protocol\" instead of \"Content-Security-Policy\". Browsers ignore that header.\n\nAny cross-site scripting flaw in the wrapped application can run scripts the policy was meant to block."}],"id":"CVE-2026-125729","lastModified":"2026-11-10T18:17:35.360","metrics":{},"published":"2026-11-10T18:17:35.360","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://github.com/pangyre/Plack-Middleware-CSP/issues/1"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/ASHLEY/Plack-Middleware-CSP-0.03/source/CHANGES"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-684"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]}
|