CVE-2014-125112

Published: Mar 26, 2026Modified: May 6, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution. Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when there is no secret used to sign the cookie.

Affected (1)

Products: Miyagawa: Plack\

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Miyagawa Plack\	Before 0.23

Related CWEs

Reliance on Cookies without Validation and Integrity Checking

The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

References (3)

https://gist.github.com/miyagawa/2b8764af908a0dacd43d

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Third Party Advisory

https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.23-TRIAL/changes

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Release Notes

http://www.openwall.com/lists/oss-security/2026/03/26/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.