Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2018-25160

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CPANSec

Description

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend. For example, if an application uses memcached for session storage, then it may be possible for a remote attacker to inject memcached commands in the session id value.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TOKUHIROM HTTP::Session2

Default version status: unaffected

  • 0 to ≤ 1.09affected

References