CVE-2014-125112

CRITICAL9.8

Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution

Published Mar 26, 2026

Modified 1 months ago

Details

Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution.

Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when there is no secret used to sign the cookie.

References

WEB

http://www.openwall.com/lists/oss-security/2026/03/26/2

WEB

https://gist.github.com/miyagawa/2b8764af908a0dacd43d

WEB

https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.23-TRIAL/changes

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2014-125112

CVSS Analysis

CVSS v3.1

9.8

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

9.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

Other

CWE-565

Ecosystems

Timeline

PublishedMar 26, 2026

ModifiedMar 26, 2026