CVE-2011-2766

HOCH 7.5CVE-2011-2766 · Published 23/09/2011 · updated 16/06/2026

Kurz gesagt

CVE-2011-2766 ist eine Schwachstelle (HOCH (CVSS 7.5)) in fast cgi (fast cgi project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 7.2%, höher als bei 94.4% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
fast cgi fast_cgi_project	`≥ 0.70, ≤ 0.73`	No fix yet

Description

The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.

References

bugs.debian.org/cgi-bin/bugreport.cgi · Exploit
debian.org/security/2011/dsa-2327 · Third Party Advisory
mandriva.com/security/advisories · Third Party Advisory
openwall.com/lists/oss-security/2011/09/08/1 · Mailing List
openwall.com/lists/oss-security/2011/09/08/2 · Mailing List
securityfocus.com/bid/49549 · Third Party Advisory
bugzilla.redhat.com/show_bug.cgi · Exploit
exchange.xforce.ibmcloud.com/vulnerabilities/69709 · Third Party Advisory
hermes.opensuse.org/messages/13154637 · Broken Link
hermes.opensuse.org/messages/13155253 · Broken Link
rt.cpan.org/Public/Bug/Display.html · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free