Read the docs
TI-2003-00572 Aliases CVE-2003-0615GHSA-8j4w-mr68-r956

Cross-site scripting (XSS) vulnerability in start_form() of CGI.pm allows remote…

Priority LOW 27Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
None · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

Cross-site scripting (XSS) vulnerability in start_form() of CGI.pm allows remote attackers to insert web script via a URL that is fed into the form's action parameter.

Why it matters now

EPSS 0.04442 91st percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:cgi.pm:cgi.pm:2.73:*:*:*:*:*:*:*2.73VulnerableCgi.pm
cpe:2.3:a:cgi.pm:cgi.pm:2.74:*:*:*:*:*:*:*2.74VulnerableCgi.pm
cpe:2.3:a:cgi.pm:cgi.pm:2.75:*:*:*:*:*:*:*2.75VulnerableCgi.pm
cpe:2.3:a:cgi.pm:cgi.pm:2.76:*:*:*:*:*:*:*2.76VulnerableCgi.pm
cpe:2.3:a:cgi.pm:cgi.pm:2.78:*:*:*:*:*:*:*2.78VulnerableCgi.pm
cpe:2.3:a:cgi.pm:cgi.pm:2.79:*:*:*:*:*:*:*2.79VulnerableCgi.pm
cpe:2.3:a:cgi.pm:cgi.pm:2.93:*:*:*:*:*:*:*2.93VulnerableCgi.pm
cpe:2.3:a:cgi.pm:cgi.pm:2.751:*:*:*:*:*:*:*2.751VulnerableCgi.pm
cpe:2.3:a:cgi.pm:cgi.pm:2.753:*:*:*:*:*:*:*2.753VulnerableCgi.pm
cpe:2.3:a:openpkg:openpkg:1.2:*:*:*:*:*:*:*1.2VulnerableOpenpkg
  • cpe:2.3:a:cgi.pm:cgi.pm:2.73:*:*:*:*:*:*:* Versions 2.73 Vulnerable ·Cgi.pm
  • cpe:2.3:a:cgi.pm:cgi.pm:2.74:*:*:*:*:*:*:* Versions 2.74 Vulnerable ·Cgi.pm
  • cpe:2.3:a:cgi.pm:cgi.pm:2.75:*:*:*:*:*:*:* Versions 2.75 Vulnerable ·Cgi.pm
  • cpe:2.3:a:cgi.pm:cgi.pm:2.76:*:*:*:*:*:*:* Versions 2.76 Vulnerable ·Cgi.pm
  • cpe:2.3:a:cgi.pm:cgi.pm:2.78:*:*:*:*:*:*:* Versions 2.78 Vulnerable ·Cgi.pm
  • cpe:2.3:a:cgi.pm:cgi.pm:2.79:*:*:*:*:*:*:* Versions 2.79 Vulnerable ·Cgi.pm
  • cpe:2.3:a:cgi.pm:cgi.pm:2.93:*:*:*:*:*:*:* Versions 2.93 Vulnerable ·Cgi.pm
  • cpe:2.3:a:cgi.pm:cgi.pm:2.751:*:*:*:*:*:*:* Versions 2.751 Vulnerable ·Cgi.pm
  • cpe:2.3:a:cgi.pm:cgi.pm:2.753:*:*:*:*:*:*:* Versions 2.753 Vulnerable ·Cgi.pm
  • cpe:2.3:a:openpkg:openpkg:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Openpkg
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:openpkg:openpkg:1.3:*:*:*:*:*:*:*1.3VulnerableOpenpkg
cpe:2.3:a:openpkg:openpkg:current:*:*:*:*:*:*:*currentVulnerableOpenpkg
cpe:2.3:o:debian:debian_linux:3.0:*:alpha:*:*:*:*:*3.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.0:*:arm:*:*:*:*:*3.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.0:*:hppa:*:*:*:*:*3.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.0:*:ia-32:*:*:*:*:*3.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.0:*:ia-64:*:*:*:*:*3.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.0:*:m68k:*:*:*:*:*3.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.0:*:mips:*:*:*:*:*3.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.0:*:mipsel:*:*:*:*:*3.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.0:*:ppc:*:*:*:*:*3.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.0:*:s-390:*:*:*:*:*3.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.0:*:sparc:*:*:*:*:*3.0VulnerableDebian
  • cpe:2.3:a:openpkg:openpkg:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Openpkg
  • cpe:2.3:a:openpkg:openpkg:current:*:*:*:*:*:*:* Versions current Vulnerable ·Openpkg
  • cpe:2.3:o:debian:debian_linux:3.0:*:alpha:*:*:*:*:* Versions 3.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.0:*:arm:*:*:*:*:* Versions 3.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.0:*:hppa:*:*:*:*:* Versions 3.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.0:*:ia-32:*:*:*:*:* Versions 3.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.0:*:ia-64:*:*:*:*:* Versions 3.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.0:*:m68k:*:*:*:*:* Versions 3.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.0:*:mips:*:*:*:*:* Versions 3.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.0:*:mipsel:*:*:*:*:* Versions 3.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.0:*:ppc:*:*:*:*:* Versions 3.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.0:*:s-390:*:*:*:*:* Versions 3.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.0:*:sparc:*:*:*:*:* Versions 3.0 Vulnerable ·Debian

Remediation

Red Hat 2 advisories

  • RHSA-2003:256 Released 2003-09-22 · Red Hat rating Important
    : : : Updated Perl packages fix security issues.
    • Red Hat Linux 7.1
    • Red Hat Linux 7.2
    • Red Hat Linux 7.3
    • Red Hat Linux 8.0
    • Red Hat Linux 9
  • RHSA-2003:257 Released 2003-09-22 · Red Hat rating Important
    perl security update
    • Red Hat Enterprise Linux AS (Advanced Server) version 2.1
    • Red Hat Enterprise Linux ES version 2.1
    • Red Hat Enterprise Linux WS version 2.1
    • Red Hat Linux Advanced Workstation 2.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 Fixed RHSA-2003:257
Red Hat Enterprise Linux ES version 2.1Fixed RHSA-2003:257
Red Hat Enterprise Linux WS version 2.1Fixed RHSA-2003:257
Red Hat Linux 7.1Fixed RHSA-2003:256
Red Hat Linux 7.2Fixed RHSA-2003:256
Red Hat Linux 7.3Fixed RHSA-2003:256
Red Hat Linux 8.0Fixed RHSA-2003:256
Red Hat Linux 9Fixed RHSA-2003:256
Red Hat Linux Advanced Workstation 2.1Fixed RHSA-2003:257

Timeline

  1. 2026-10-02 Threatist record created from CVE-2003-0615
  2. 2026-10-03 Alias added: GHSA-8j4w-mr68-r956

References

Advisory 7

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences