DEBIAN-CVE-2015-10149
- Source
- https://security-tracker.debian.org/tracker/CVE-2015-10149
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2015-10149.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2015-10149
- Upstream
- CVE-2015-10149
- Published
- 2026-11-14T20:17:39Z
- Modified
- 2026-11-15T05:00:03Z
- Summary
- [none]
- Details
-
Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine. read_session_id returns the cookie value as the session id without checking its characters, and Dancer hands it to the session engine to load the session. A remote attacker may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query without checking it.
- References
Affected packages
Debian:12 / libdancer-perl
Package
- Name
- libdancer-perl
- Purl
- pkg:deb/debian/libdancer-perl?arch=source&distro=bookworm
Debian:13 / libdancer-perl
Package
- Name
- libdancer-perl
- Purl
- pkg:deb/debian/libdancer-perl?arch=source&distro=trixie
Debian:14 / libdancer-perl
Package
- Name
- libdancer-perl
- Purl
- pkg:deb/debian/libdancer-perl?arch=source&distro=forky