> CVE-2018-25160

« BACK_TO_HOME
PUBLISHED
2026-02-27 21:16
MODIFIED
2026-02-27 21:16
EPSS (Prob. Exploit)
0.42%
Top 64.7%
DATA SOURCES:
NVD 🔗 2026-02-27 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 OSV 🔗 2026-07-26

> DESCRIPTION

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend. For example, if an application uses memcached for session storage, then it may be possible for a remote attacker to inject memcached commands in the session id value.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-20

> CWE DETAILED DESCRIPTIONS

CWE-20: Improper Input Validation - The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:
Unknown / Unknown
15 versions affected

> HISTORIQUE DES MODIFICATIONS

Première apparition
27/02/2026 21:16
Source: NVD
📊 ENRICHISSEMENT 01/03/2026 06:46
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-20: Improper Input Validation - The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process...
Total des modifications: 1 Dernière mise à jour: 8 months ago

> REFERENCES

https://github.com/tokuhirom/HTTP-Session2/commit/813838f6d08034b6a265a70e53b59b...
https://metacpan.org/pod/Cache::Memcached::Fast::Safe
https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.10/source/Changes
« BACK_TO_HOME