PT-2026-28191 · Unknown · Plack::Middleware::Session::Cookie

CVE-2014-125112 · Publicado 2014-01-01 · Atualizado 2026-05-06

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Plack::Middleware::Session::Cookie versions through 0.21

Description Plack::Middleware::Session::Cookie versions through 0.21 allows remote code execution. The issue occurs during deserialization of cookie data when no secret is used to sign the cookie, enabling an attacker to execute arbitrary code on the server.

Recommendations Update Plack::Middleware::Session::Cookie to a version later than 0.21.

Correção

RCE

Enumeração de Fraquezas

CWE-565

Identificadores relacionados

CVE-2014-125112

Produtos afetados

Plack::Middleware::Session::Cookie

Referências · 12

• http://openwall.com/lists/oss-security/2026/03/26/2 · Nota
• https://lists.security.metacpan.org/cve-announce/msg/38287006 · Nota
• https://ubuntu.com/security/CVE-2014-125112 · Aviso do Fabricante
• https://t.me/cveNotify/162365 · Publicação no Telegram
• https://twitter.com/oss_security/status/2037710834206375981 · Publicação no Twitter
• https://gist.github.com/miyagawa/2b8764af908a0dacd43d · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-125112 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-125112 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2014-125112 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-125112 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-125112 · Aviso do Fabricante
• https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.23-TRIAL/changes · Nota