CVE-2014-125112
Last modified
CVE-2014-125112 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution. Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when there is no secret used to sign the cookie.. EPSS estimates a 0.83% chance of exploitation in the next 30 days.
Description
Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution. Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when there is no secret used to sign the cookie.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Miyagawa | Plack\ | < 0.23 | Middleware\ |
References
- https://gist.github.com/miyagawa/2b8764af908a0dacd43dThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/03/26/2Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2014-125112?
How severe is CVE-2014-125112?
How do I fix CVE-2014-125112?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2014
- CVE-2014-125106Nanopb before 0.3.1 allows size_t overflows in pb_dec_bytes …9.8
- CVE-2014-125107A vulnerability was found in Corveda PHPSandbox 1.3.4 and cl…5.3
- CVE-2014-125108A vulnerability was found in w3c online-spellchecker-py up t…6.1
- CVE-2014-125109A vulnerability was found in BestWebSoft Portfolio Plugin up…6.1
- CVE-2014-125110A vulnerability has been found in wp-file-upload Plugin up t…3.5
- CVE-2014-125111A vulnerability was found in namithjawahar Wp-Insert up to 2…3.5
- CVE-2014-125113An unrestricted file upload vulnerability exists in Dell (ac…9.3
- CVE-2014-125114A stack-based buffer overflow vulnerability exists in i-Ftp …8.4
- CVE-2014-125115An unauthenticated SQL injection vulnerability exists in Pan…10
- CVE-2014-125116A remote code execution vulnerability exists in HybridAuth v…9.3
- CVE-2014-125117A stack-based buffer overflow vulnerability in the my_cgi.cg…9.8
- CVE-2014-125118A command injection vulnerability exists in the eScan Web Ma…9.4
Are you affected by CVE-2014-125112?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST