Session Management Flaw in Dancer Framework for Perl

CVE-2015-10149

What is CVE-2015-10149?

Dancer framework, prior to version 1.3400, suffers from a session management vulnerability that allows attackers to submit unvalidated session IDs from cookies, which are subsequently passed to the session engine without proper validation. This can lead to potential path traversal or injection attacks if the session ID is improperly handled in file paths, cache commands, or queries. It is crucial for users of the affected versions to apply the necessary patches to mitigate these risks.

References