CVE-2014-125112

Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution. Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when there is no secret used to sign the cookie.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/miyagawa/2b8764af908a0dacd43d	Third Party Advisory
https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.23-TRIAL/changes	Release Notes
http://www.openwall.com/lists/oss-security/2026/03/26/2	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:miyagawa:plack\:\:middleware\:\:session\:\:cookie:*:*:*:*:*:perl:*:*

History

No history.

Information

Published : 2026-03-26 03:16

Updated : 2026-06-17 00:04

NVD link : CVE-2014-125112

Mitre link : CVE-2014-125112

CVE.ORG link : CVE-2014-125112

JSON object : View

Products Affected

miyagawa

plack\

CWE

CWE-565

Reliance on Cookies without Validation and Integrity Checking

{"id": "CVE-2014-125112", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2014-125112", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-26T14:52:33.130571Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/plack/Plack-Middleware-Session", "vendor": "MIYAGAWA", "product": "Plack::Middleware::Session::Cookie", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.21"}], "packageName": "Plack-Middleware-Session", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected"}]}], "published": "2026-03-26T03:16:00.423", "references": [{"url": "https://gist.github.com/miyagawa/2b8764af908a0dacd43d", "tags": ["Third Party Advisory"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.23-TRIAL/changes", "tags": ["Release Notes"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/03/26/2", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-565"}]}], "descriptions": [{"lang": "en", "value": "Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution.\n\nPlack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when there is no secret used to sign the cookie."}, {"lang": "es", "value": "Las versiones de Plack::Middleware::Session::Cookie hasta la 0.21 para Perl permiten la ejecuci\u00f3n remota de c\u00f3digo.\n\nLas versiones de Plack::Middleware::Session::Cookie hasta la 0.21 tienen una vulnerabilidad de seguridad que permite a un atacante ejecutar c\u00f3digo arbitrario en el servidor durante la deserializaci\u00f3n de los datos de la cookie, cuando no se utiliza ning\u00fan secreto para firmar la cookie."}], "lastModified": "2026-06-17T00:04:29.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:miyagawa:plack\\:\\:middleware\\:\\:session\\:\\:cookie:*:*:*:*:*:perl:*:*", "vulnerable": true, "matchCriteriaId": "B0973619-DAA2-4B3C-BF1E-5C1EDD60F202", "versionEndExcluding": "0.23"}], "operator": "OR"}]}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}