جزئیات آسیب‌پذیری

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite.

• https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI/Cookie.pm technical-description
• https://metacpan.org/release/LEEJO/CGI-5.00/changes release-notes
• https://github.com/leejo/CGI.pm/commit/0b3527faaa9de55f79ca7d59dd3bcfb2c5540e00.patch patch