CVEvulnerability
CVE-2014-125112
9.8 CRITICAL
Official page ↗
- Status
- Analyzed
- Published
- 2026-03-26
- Last modified
- 2026-06-17
- Assigner
- 9b29abf9-4ab0-4765-b253-1875cd9b441e
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-565
Description
Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution.
Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when there is no secret used to sign the cookie.
Affected configurations
• miyagawa plack\ \ (< 0.23)
Related
Weakness · CWE (1)
- CWE-565 Reliance on Cookies without Validation and Integrity Checking weakness
References
- https://gist.github.com/miyagawa/2b8764af908a0dacd43d Third Party Advisory
- https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.23-TRIAL/changes Release Notes
- http://www.openwall.com/lists/oss-security/2026/03/26/2 Mailing List, Third Party Advisory