Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2015-10149

Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CPANSec

Description

Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine. read_session_id returns the cookie value as the session id without checking its characters, and Dancer hands it to the session engine to load the session. A remote attacker may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query without checking it.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Dancer

Default version status: unaffected

  • 0 to < 1.3400affected
pkg:cpan/Dancer

References