Description
Cross-site scripting (XSS) vulnerability in start_form() of CGI.pm allows remote attackers to insert web script via a URL that is fed into the form's action parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | perl | 5.8.0-19 | — |
| Debian 13 | perl | 5.8.0-19 | — |
| Debian 12 | perl | 5.8.0-19 | — |
| Debian 3.0 | perl | 5.6.1-8.3 | DSA-371 |
Advisories 1
- DSA-371 perl - cross-site scripting Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20030720 CGI.pm vulnerable to Cross-site Scripting. mailing-list
- MDKSA-2003:084 vendor-advisory
- DSA-371 vendor-advisory
- 20030720 CGI.pm vulnerable to Cross-site Scripting mailing-list
- CLA-2003:713 vendor-advisory
- N-155 third-party-advisory government-resource
- cgi-startform-xss(12669) vdb-entry
- 20030806 [OpenPKG-SA-2003.036] OpenPKG Security Advisory (perl-www) mailing-list
- 1007234 vdb-entry
- RHSA-2003:256 vendor-advisory
- 101426 vendor-advisory
- 13638 third-party-advisory
- oval:org.mitre.oval:def:470 vdb-entry signature
- oval:org.mitre.oval:def:307 vdb-entry signature
- 8231 vdb-entry
- VU#246409 third-party-advisory