NVD

Id
46652  
Name
CVE-2012-5526  
Description
CGI.pm module before 3.63 for Perl does not properly escape newlines in (1) Set-Cookie or (2) P3P headers, which might allow remote attackers to inject arbitrary headers into responses from applications that use CGI.pm.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2012-11-21  
Modified Date
2016-12-07  
Seq
2012-5526  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
233687 46652 CVE-2012-5526 http://cpansearch.perl.org/src/MARKSTOS/CGI.pm-3.63/Changes  View
233688 46652 CVE-2012-5526 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705  View
233689 46652 CVE-2012-5526 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735  View
233690 46652 CVE-2012-5526 RHSA-2013:0685  View
233691 46652 CVE-2012-5526 DSA-2586  View
233692 46652 CVE-2012-5526 [oss-security] 20121115 Re: CVE Request -- perl-CGI: Newline injection due to improper CRLF escaping in Set-Cookie and P3P headers  View
233693 46652 CVE-2012-5526 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html  View
233694 46652 CVE-2012-5526 56562  View
233695 46652 CVE-2012-5526 1027780  View
233696 46652 CVE-2012-5526 USN-1643-1  View
233697 46652 CVE-2012-5526 perl-cgipm-header-injection(80098)  View
233698 46652 CVE-2012-5526 https://github.com/markstos/CGI.pm/pull/23  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
29798 JVNDB-2012-005505 Perl 用 CGI.pm モジュールにおける改行を挿入される脆弱性 Perl 用 CGI.pm モジュールは、(1) Set-Cookie、または (2) P3P ヘッダに含まれる改行を適切にエスケープしないため、CGI.pm を使用するアプリケーションからのレスポンスの任意のヘッダに改行を挿入される脆弱性が存在します。 CVE-2012-5526 58764 CVE-2012-5526 46652 5 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-005505.html 2012-11-12 2013-11-01 View