CVE-2026-120638
2026-11-04
00h17 +00:00
00h17 +00:00
特定のCVEの通知
特定のCVEの変更情報をいち早くお届けします。
CVE の説明
CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect.
redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.
CVE の情報
関連する弱点
| 弱点名 | 出典 | |
|---|---|---|
| Incorrect Behavior Order: Validate Before Canonicalize The product validates input before it is canonicalized. |
||
| URL Redirection to Untrusted Site The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. |
