CVE-2012-5526 Other in n/a
Remote attackers can inject arbitrary HTTP headers into responses from Perl applications using the CGI.pm module due to improper newline escaping.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-5526?
CVE-2012-5526 is a medium-severity vulnerability in n/a, published on 21 Nov 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CGI.pm module before 3.63 for Perl does not properly escape newlines in (1) Set-Cookie or (2) P3P headers, which might allow remote attackers to inject arbitrary headers into responses from applications that use CGI.pm.
Weakness: CWE-16
Which versions are affected by CVE-2012-5526?
It affects 1 product.
Products include Andy Armstrong Cgi.pm.
How do I fix CVE-2012-5526?
Upgrade to a fixed version.
Is CVE-2012-5526 being exploited?
There is no known exploitation of CVE-2012-5526 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2012-5526, DSA-2587-1, GHSA-9x3m-wmpr-vc58.