PT-2026-28191 · Unknown · Plack::Middleware::Session::Cookie

Published 2014-01-01 · Updated 2026-05-06 · CVE-2014-125112

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Plack::Middleware::Session::Cookie versions through 0.21

Description Plack::Middleware::Session::Cookie versions through 0.21 allows remote code execution. The issue occurs during deserialization of cookie data when no secret is used to sign the cookie, enabling an attacker to execute arbitrary code on the server.

Recommendations Update Plack::Middleware::Session::Cookie to a version later than 0.21.

Fix

RCE

Weakness Enumeration

CWE-565

Related Identifiers

CVE-2014-125112

Affected Products

Plack::Middleware::Session::Cookie

References · 12

• https://ubuntu.com/security/CVE-2014-125112 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-125112 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-125112 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-125112 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-125112 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-125112 · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/03/26/2 · Note
• https://lists.security.metacpan.org/cve-announce/msg/38287006 · Note
• https://t.me/cveNotify/162365 · Telegram Post
• https://twitter.com/oss_security/status/2037710834206375981 · Twitter Post
• https://gist.github.com/miyagawa/2b8764af908a0dacd43d · Note
• https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.23-TRIAL/changes · Note