CVE-2014-125112 - Vulnerability Analysis

Overview

Plack::Middleware::Session::Cookie <= 0.21 for Perl contains an insecure deserialization vulnerability caused by lack of cookie signing secret, letting remote attackers execute arbitrary code during cookie deserialization, exploit requires unsigned cookies.

Severity & Score

Impact

Remote attackers can execute arbitrary code on the server, potentially leading to full system compromise.

Mitigation

Update to a version later than 0.21 or apply cookie signing with a secret.

References

• https://gist.github.com/miyagawa/2b8764af908a0dacd43d
• https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.23-TRIAL/changes
• http://www.openwall.com/lists/oss-security/2026/03/26/2

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner