CVE-2014-125112

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-125112
Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution. Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when there is no secret used to sign the cookie.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://gist.github.com/miyagawa/2b8764af908a0dacd43d Third Party Advisory
https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.23-TRIAL/changes Release Notes
http://www.openwall.com/lists/oss-security/2026/03/26/2 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:miyagawa:plack\:\:middleware\:\:session\:\:cookie:*:*:*:*:*:perl:*:*
History

06 May 2026, 14:50

Type Values Removed Values Added
First Time Miyagawa plack\
Miyagawa
Summary
  • (es) Las versiones de Plack::Middleware::Session::Cookie hasta la 0.21 para Perl permiten la ejecución remota de código. Las versiones de Plack::Middleware::Session::Cookie hasta la 0.21 tienen una vulnerabilidad de seguridad que permite a un atacante ejecutar código arbitrario en el servidor durante la deserialización de los datos de la cookie, cuando no se utiliza ningún secreto para firmar la cookie.
CPE cpe:2.3:a:miyagawa:plack\:\:middleware\:\:session\:\:cookie:*:*:*:*:*:perl:*:*
References () https://gist.github.com/miyagawa/2b8764af908a0dacd43d - () https://gist.github.com/miyagawa/2b8764af908a0dacd43d - Third Party Advisory
References () https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.23-TRIAL/changes - () https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.23-TRIAL/changes - Release Notes
References () http://www.openwall.com/lists/oss-security/2026/03/26/2 - () http://www.openwall.com/lists/oss-security/2026/03/26/2 - Mailing List, Third Party Advisory

26 Mar 2026, 15:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8

26 Mar 2026, 05:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/03/26/2 -

26 Mar 2026, 03:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-26 03:16

Updated : 2026-05-06 14:50

NVD link : CVE-2014-125112

Mitre link : CVE-2014-125112

CVE.ORG link : CVE-2014-125112

JSON object : View

Products Affected

miyagawa

  • plack\
CWE
CWE-565

Reliance on Cookies without Validation and Integrity Checking