Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2018-25160

Summary
Assigner-CPANSec
Assigner Org ID-9b29abf9-4ab0-4765-b253-1875cd9b441e
Published At-27 Feb, 2026 | 20:15
Updated At-27 Feb, 2026 | 20:15
Rejected At-
Credits

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend. For example, if an application uses memcached for session storage, then it may be possible for a remote attacker to inject memcached commands in the session id value.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:CPANSec
Assigner Org ID:9b29abf9-4ab0-4765-b253-1875cd9b441e
Published At:27 Feb, 2026 | 20:15
Updated At:27 Feb, 2026 | 20:15
Rejected At:
▼CVE Numbering Authority (CNA)
HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend. For example, if an application uses memcached for session storage, then it may be possible for a remote attacker to inject memcached commands in the session id value.

Affected Products
Vendor
TOKUHIROM
Product
HTTP::Session2
Collection URL
https://cpan.org/modules
Package Name
HTTP-Session2
Repo
https://github.com/tokuhirom/HTTP-Session2
Default Status
unaffected
Versions
Affected
  • From 0 through 1.09 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-20CWE-20 Improper Input Validation
Type: CWE
CWE ID: CWE-20
Description: CWE-20 Improper Input Validation
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-248CAPEC-248 Command Injection
CAPEC ID: CAPEC-248
Description: CAPEC-248 Command Injection
Solutions

HTTP::Session2 has been deprecated since version 1.11, users are recommended to migrate to a different solution.

Configurations
Workarounds

Upgrade to version 1.10 or later. Use a session storage module that offers protection against command injections, such as Cache::Memcached::Fast::Safe.

Exploits
Credits
Timeline
EventDate
version 1.10 HTTP::Session2 released with fix.2018-01-26 00:00:00
version 1.11 HTTP::Session2 deprecated.2026-02-24 00:00:00
Event: version 1.10 HTTP::Session2 released with fix.
Date: 2018-01-26 00:00:00
Event: version 1.11 HTTP::Session2 deprecated.
Date: 2026-02-24 00:00:00
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/tokuhirom/HTTP-Session2/commit/813838f6d08034b6a265a70e53b59b941b5d3e6d.patch
patch
https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.10/source/Changes
release-notes
https://metacpan.org/pod/Cache::Memcached::Fast::Safe
related
Hyperlink: https://github.com/tokuhirom/HTTP-Session2/commit/813838f6d08034b6a265a70e53b59b941b5d3e6d.patch
Resource:
patch
Hyperlink: https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.10/source/Changes
Resource:
release-notes
Hyperlink: https://metacpan.org/pod/Cache::Memcached::Fast::Safe
Resource:
related
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:9b29abf9-4ab0-4765-b253-1875cd9b441e
Published At:27 Feb, 2026 | 21:16
Updated At:27 Feb, 2026 | 21:16

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend. For example, if an application uses memcached for session storage, then it may be possible for a remote attacker to inject memcached commands in the session id value.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
CPE Matches
Weaknesses
CWE IDTypeSource
CWE-20Secondary9b29abf9-4ab0-4765-b253-1875cd9b441e
CWE ID: CWE-20
Type: Secondary
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://github.com/tokuhirom/HTTP-Session2/commit/813838f6d08034b6a265a70e53b59b941b5d3e6d.patch9b29abf9-4ab0-4765-b253-1875cd9b441e
N/A
https://metacpan.org/pod/Cache::Memcached::Fast::Safe9b29abf9-4ab0-4765-b253-1875cd9b441e
N/A
https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.10/source/Changes9b29abf9-4ab0-4765-b253-1875cd9b441e
N/A
Hyperlink: https://github.com/tokuhirom/HTTP-Session2/commit/813838f6d08034b6a265a70e53b59b941b5d3e6d.patch
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Resource: N/A
Hyperlink: https://metacpan.org/pod/Cache::Memcached::Fast::Safe
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Resource: N/A
Hyperlink: https://metacpan.org/release/TOKUHIROM/HTTP-Session2-1.10/source/Changes
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

0Records found
Details not found