CVE-2010-4410

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

2.04%

Published

Dec 6, 2010

Modified

Apr 28, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

CRLF injection vulnerability in the header function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors related to non-whitespace characters preceded by newline characters, a different vulnerability than CVE-2010-2761 and CVE-2010-3172.

Weaknesses (CWE)

CWE-94

Affected Products (174)

andy_armstrong · cgi.pmvulnerable

· cgi.pm

References (20)

http://cpansearch.perl.org/src/LDS/CGI.pm-3.50/Changes

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735

http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053576.html

http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053591.html

http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html

http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html

http://openwall.com/lists/oss-security/2010/12/01/1

KEV Catalog EPSS Scores Vendors All CVEs