Read the docs
TI-2010-04525 Aliases CVE-2010-4802GHSA-9wxp-xqhf-2m53

Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment…

Priority MEDIUM 47CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment detection, which has unspecified impact and remote attack vectors.

Why it matters now

EPSS 0.02078 81st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 59

CPEVersionsRoleVendor
cpe:2.3:a:mojolicious:mojolicious:*:*:*:*:*:*:*:*up to 0.999927VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.2:*:*:*:*:*:*:*0.2VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.3:*:*:*:*:*:*:*0.3VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.4:*:*:*:*:*:*:*0.4VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.5:*:*:*:*:*:*:*0.5VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.6:*:*:*:*:*:*:*0.6VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.7:*:*:*:*:*:*:*0.7VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.8:*:*:*:*:*:*:*0.8VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.8.1:*:*:*:*:*:*:*0.8.1VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.8.2:*:*:*:*:*:*:*0.8.2VulnerableMojolicious
  • cpe:2.3:a:mojolicious:mojolicious:*:*:*:*:*:*:*:* Versions up to 0.999927 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.2:*:*:*:*:*:*:* Versions 0.2 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.3:*:*:*:*:*:*:* Versions 0.3 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.4:*:*:*:*:*:*:* Versions 0.4 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.5:*:*:*:*:*:*:* Versions 0.5 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.6:*:*:*:*:*:*:* Versions 0.6 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.7:*:*:*:*:*:*:* Versions 0.7 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.8:*:*:*:*:*:*:* Versions 0.8 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.8.1:*:*:*:*:*:*:* Versions 0.8.1 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.8.2:*:*:*:*:*:*:* Versions 0.8.2 Vulnerable ·Mojolicious
Show 49 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:mojolicious:mojolicious:0.8.3:*:*:*:*:*:*:*0.8.3VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.8.4:*:*:*:*:*:*:*0.8.4VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.8.5:*:*:*:*:*:*:*0.8.5VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.9:*:*:*:*:*:*:*0.9VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.8006:*:*:*:*:*:*:*0.8006VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.8007:*:*:*:*:*:*:*0.8007VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.8008:*:*:*:*:*:*:*0.8008VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.8009:*:*:*:*:*:*:*0.8009VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.9001:*:*:*:*:*:*:*0.9001VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.9002:*:*:*:*:*:*:*0.9002VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.991231:*:*:*:*:*:*:*0.991231VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.991232:*:*:*:*:*:*:*0.991232VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.991233:*:*:*:*:*:*:*0.991233VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.991234:*:*:*:*:*:*:*0.991234VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.991235:*:*:*:*:*:*:*0.991235VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.991236:*:*:*:*:*:*:*0.991236VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.991237:*:*:*:*:*:*:*0.991237VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.991238:*:*:*:*:*:*:*0.991238VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.991239:*:*:*:*:*:*:*0.991239VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.991240:*:*:*:*:*:*:*0.991240VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.991241:*:*:*:*:*:*:*0.991241VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.991242:*:*:*:*:*:*:*0.991242VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.991243:*:*:*:*:*:*:*0.991243VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.991244:*:*:*:*:*:*:*0.991244VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.991245:*:*:*:*:*:*:*0.991245VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.991246:*:*:*:*:*:*:*0.991246VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.991250:*:*:*:*:*:*:*0.991250VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.991251:*:*:*:*:*:*:*0.991251VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.999901:*:*:*:*:*:*:*0.999901VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.999902:*:*:*:*:*:*:*0.999902VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.999903:*:*:*:*:*:*:*0.999903VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.999904:*:*:*:*:*:*:*0.999904VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.999905:*:*:*:*:*:*:*0.999905VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.999906:*:*:*:*:*:*:*0.999906VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.999907:*:*:*:*:*:*:*0.999907VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.999908:*:*:*:*:*:*:*0.999908VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.999909:*:*:*:*:*:*:*0.999909VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.999910:*:*:*:*:*:*:*0.999910VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.999911:*:*:*:*:*:*:*0.999911VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.999912:*:*:*:*:*:*:*0.999912VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.999913:*:*:*:*:*:*:*0.999913VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.999914:*:*:*:*:*:*:*0.999914VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.999920:*:*:*:*:*:*:*0.999920VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.999921:*:*:*:*:*:*:*0.999921VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.999922:*:*:*:*:*:*:*0.999922VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.999923:*:*:*:*:*:*:*0.999923VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.999924:*:*:*:*:*:*:*0.999924VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.999925:*:*:*:*:*:*:*0.999925VulnerableMojolicious
cpe:2.3:a:mojolicious:mojolicious:0.999926:*:*:*:*:*:*:*0.999926VulnerableMojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.8.3:*:*:*:*:*:*:* Versions 0.8.3 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.8.4:*:*:*:*:*:*:* Versions 0.8.4 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.8.5:*:*:*:*:*:*:* Versions 0.8.5 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.9:*:*:*:*:*:*:* Versions 0.9 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.8006:*:*:*:*:*:*:* Versions 0.8006 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.8007:*:*:*:*:*:*:* Versions 0.8007 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.8008:*:*:*:*:*:*:* Versions 0.8008 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.8009:*:*:*:*:*:*:* Versions 0.8009 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.9001:*:*:*:*:*:*:* Versions 0.9001 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.9002:*:*:*:*:*:*:* Versions 0.9002 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.991231:*:*:*:*:*:*:* Versions 0.991231 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.991232:*:*:*:*:*:*:* Versions 0.991232 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.991233:*:*:*:*:*:*:* Versions 0.991233 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.991234:*:*:*:*:*:*:* Versions 0.991234 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.991235:*:*:*:*:*:*:* Versions 0.991235 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.991236:*:*:*:*:*:*:* Versions 0.991236 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.991237:*:*:*:*:*:*:* Versions 0.991237 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.991238:*:*:*:*:*:*:* Versions 0.991238 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.991239:*:*:*:*:*:*:* Versions 0.991239 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.991240:*:*:*:*:*:*:* Versions 0.991240 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.991241:*:*:*:*:*:*:* Versions 0.991241 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.991242:*:*:*:*:*:*:* Versions 0.991242 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.991243:*:*:*:*:*:*:* Versions 0.991243 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.991244:*:*:*:*:*:*:* Versions 0.991244 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.991245:*:*:*:*:*:*:* Versions 0.991245 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.991246:*:*:*:*:*:*:* Versions 0.991246 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.991250:*:*:*:*:*:*:* Versions 0.991250 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.991251:*:*:*:*:*:*:* Versions 0.991251 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.999901:*:*:*:*:*:*:* Versions 0.999901 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.999902:*:*:*:*:*:*:* Versions 0.999902 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.999903:*:*:*:*:*:*:* Versions 0.999903 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.999904:*:*:*:*:*:*:* Versions 0.999904 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.999905:*:*:*:*:*:*:* Versions 0.999905 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.999906:*:*:*:*:*:*:* Versions 0.999906 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.999907:*:*:*:*:*:*:* Versions 0.999907 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.999908:*:*:*:*:*:*:* Versions 0.999908 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.999909:*:*:*:*:*:*:* Versions 0.999909 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.999910:*:*:*:*:*:*:* Versions 0.999910 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.999911:*:*:*:*:*:*:* Versions 0.999911 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.999912:*:*:*:*:*:*:* Versions 0.999912 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.999913:*:*:*:*:*:*:* Versions 0.999913 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.999914:*:*:*:*:*:*:* Versions 0.999914 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.999920:*:*:*:*:*:*:* Versions 0.999920 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.999921:*:*:*:*:*:*:* Versions 0.999921 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.999922:*:*:*:*:*:*:* Versions 0.999922 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.999923:*:*:*:*:*:*:* Versions 0.999923 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.999924:*:*:*:*:*:*:* Versions 0.999924 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.999925:*:*:*:*:*:*:* Versions 0.999925 Vulnerable ·Mojolicious
  • cpe:2.3:a:mojolicious:mojolicious:0.999926:*:*:*:*:*:*:* Versions 0.999926 Vulnerable ·Mojolicious

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-4802
  2. 2026-10-03 Alias added: GHSA-9wxp-xqhf-2m53

References

Patch 3

Advisory 1

Other 1

  • TI-2024-38343 Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session… CVSS 3.1MEDIUM 5.3
  • TI-2021-21869 The Mojolicious module before 9.11 for Perl has a bug in format detection that can… CVSS 3.1MEDIUM 4.3
  • TI-2010-04526 Mojolicious before 0.999927 does not properly implement HMAC-MD5 checksums, which has… CVSS 2.0HIGH 10.0
  • TI-2009-04826 Unspecified vulnerability in the MojoX::Dispatcher::Static implementation in Mojolicious… CVSS 2.0HIGH 10.0
  • TI-2024-38342 Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the… CVSS 3.1HIGH 8.1
  • TI-2011-01408 Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote… CVSS 2.0MEDIUM 5.0
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences