{"affected":[{"defaultStatus":"unaffected","ecosystem":"cpan","packageName":"Dancer","product":"","source":"CNA: CPANSec","vendor":"","versions":[{"lessThan":"1.3400","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2015-10149","cwes":["CWE-1286"],"description":"Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine.\n\nread_session_id returns the cookie value as the session id without checking its characters, and Dancer hands it to the session engine to load the session.\n\nA remote attacker may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query without checking it.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1794687058771,"publishedAt":1794687058771,"references":[{"source":"CNA: CPANSec","tags":["patch"],"url":"https://github.com/PerlDancer/Dancer/commit/5a68fddbaef903fd3bd58517ce585cde986716e4.patch"},{"source":"CNA: CPANSec","tags":["issue-tracking"],"url":"https://github.com/PerlDancer/Dancer/issues/1117"},{"source":"CNA: CPANSec","tags":["issue-tracking"],"url":"https://github.com/PerlDancer/Dancer/issues/1118"},{"source":"CNA: CPANSec","tags":["issue-tracking"],"url":"https://github.com/PerlDancer/Dancer/pull/1172"},{"source":"CNA: CPANSec","tags":["release-notes"],"url":"https://metacpan.org/release/BIGPRESH/Dancer-1.3400/changes"}],"remediation":[{"kind":"fix","source":"CNA: CPANSec","text":"Upgrade to Dancer 1.3400 or later."},{"kind":"fix","source":"CNA: CPANSec","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/PerlDancer/Dancer/commit/5a68fddbaef903fd3bd58517ce585cde986716e4.patch"}],"revision":"3dab7a716571d652f2737f3bd12681ef487d6fa0bd6f7830fd29253fb338caf1","sources":[{"modifiedAt":1794687058771,"name":"CNA: CPANSec","retrievedAt":1794690498725,"url":"https://www.cve.org/CVERecord?id=CVE-2015-10149"}],"ssvc":null,"status":"published","title":"Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine","updatedAt":1794690498725}