{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-40927","assignerOrgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","state":"PUBLISHED","assignerShortName":"CPANSec","dateReserved":"2025-04-16T09:05:34.362Z","datePublished":"2025-08-29T00:10:07.161Z","dateUpdated":"2025-08-29T13:18:32.704Z"},"containers":{"cna":{"affected":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","packageName":"CGI-Simple","product":"CGI::Simple","programFiles":["lib/CGI/Simple.pm"],"repo":"https://github.com/manwar/CGI--Simple","vendor":"MANWAR","versions":[{"lessThan":"1.282","status":"affected","version":"0","versionType":"custom"}]}],"credits":[{"lang":"en","type":"finder","value":"Maxim Kosenko"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw<br><p>This vulnerability is a <strong>confirmed HTTP response splitting</strong>&nbsp;flaw in <code>CGI::Simple</code>&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions</span>.</p><p>Although some validation exists, it can be bypassed using URL-encoded values, allowing an attacker to inject untrusted content into the response via query parameters.</p><p></p><p>As a result, an attacker can inject a line break (e.g. <code>%0A</code>) into the parameter value, causing the server to split the HTTP response and inject arbitrary headers or even an HTML/JavaScript body, leading to reflected cross-site scripting (XSS), open redirect or other attacks.</p><p>The issue documented in&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.cve.org/CVERecord?id=CVE-2010-4410\">CVE-2010-4410</a><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;is related but the fix was incomplete.</span>&nbsp;</p><p><strong>Impact</strong></p><p>By injecting <code>%0A</code>&nbsp;(newline) into a query string parameter, an attacker can:</p><ol><li>Break the current HTTP header</li><li>Inject a new header or entire body</li><li>Deliver a script payload that is reflected in the server’s response</li></ol><p>That can lead to the following attacks:</p><ul><li>reflected XSS</li><li>open redirect</li><li>cache poisoning</li><li>header manipulation</li></ul><br>"}],"value":"CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw\nThis vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions.\n\nAlthough some validation exists, it can be bypassed using URL-encoded values, allowing an attacker to inject untrusted content into the response via query parameters.\n\n\n\nAs a result, an attacker can inject a line break (e.g. %0A) into the parameter value, causing the server to split the HTTP response and inject arbitrary headers or even an HTML/JavaScript body, leading to reflected cross-site scripting (XSS), open redirect or other attacks.\n\nThe issue documented in CVE-2010-4410 https://www.cve.org/CVERecord?id=CVE-2010-4410 is related but the fix was incomplete.\n\nImpact\n\nBy injecting %0A (newline) into a query string parameter, an attacker can:\n\n  *  Break the current HTTP header\n  *  Inject a new header or entire body\n  *  Deliver a script payload that is reflected in the server’s response\nThat can lead to the following attacks:\n\n  *  reflected XSS\n  *  open redirect\n  *  cache poisoning\n  *  header manipulation"}],"impacts":[{"capecId":"CAPEC-34","descriptions":[{"lang":"en","value":"CAPEC-34 HTTP Response Splitting"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-113","description":"CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"orgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","shortName":"CPANSec","dateUpdated":"2025-08-29T00:10:07.161Z"},"references":[{"tags":["related"],"url":"https://metacpan.org/release/MANWAR/CGI-Simple-1.281/source/lib/CGI/Simple.pm#L1031-1035"},{"tags":["related"],"url":"https://metacpan.org/release/MANWAR/CGI-Simple-1.281/diff/MANWAR/CGI-Simple-1.282/lib/CGI/Simple.pm"},{"tags":["technical-description"],"url":"https://owasp.org/www-community/attacks/HTTP_Response_Splitting"},{"tags":["technical-description"],"url":"https://datatracker.ietf.org/doc/html/rfc7230#section-3"},{"tags":["related"],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2320"},{"tags":["related"],"url":"https://rt.perl.org/Public/Bug/Display.html?id=21951"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Upgrade CGI::Simple to version 1.282 or higher"}],"value":"Upgrade CGI::Simple to version 1.282 or higher"}],"source":{"discovery":"EXTERNAL"},"title":"CGI::Simple versions 1.281 and earlier for Perl has a HTTP response splitting flaw","x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-08-29T13:18:01.758812Z","id":"CVE-2025-40927","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-08-29T13:18:32.704Z"}}]}}