CVE-2009-10007: falha crítica em ETHER Catalyst::Plugin::Authentication
Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks
Publicada em
Seguir esta CVE+ Monitorar Catalyst::Plugin::Authentication+ Monitorar libcatalyst-plugin-authentication-perl
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.4%
Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks.
Catalyst::Plugin::Authentication does not automatically change the session id after authentication. An attacker that obtains a session id cookie can use this to impersonate the victim.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
ETHER · Catalyst::Plugin::AuthenticationReferências
https://github.com/perl-catalyst/Catalyst-Plugin-Authentication/commit/b1385ea87a2491b64f33169222af19982d0acce3.patchhttps://metacpan.org/pod/Catalyst::Plugin::Session#change_session_idhttps://metacpan.org/pod/Plack::Middleware::Session#change_idhttps://metacpan.org/release/ETHER/Catalyst-Plugin-Authentication-0.10_027/changeshttp://www.openwall.com/lists/oss-security/2026/06/09/10