{"id":"CVE-2015-10149","aliases":[],"cve":{"records":[{"id":"CVE-2015-10149","source":"CPANSec","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-14T19:54:01.601Z","published":"2026-11-14T20:10:58.771Z","modified":"2026-11-14T23:05:03.050Z"}],"publishers":[{"name":"CPANSec","role":"CNA","organizationId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","modified":"2026-11-14T20:10:58.771Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-11-14T23:05:03.050Z"}],"references":[{"url":"https://github.com/PerlDancer/Dancer/commit/5a68fddbaef903fd3bd58517ce585cde986716e4.patch","tags":["patch"],"source":"CPANSec"},{"url":"https://github.com/PerlDancer/Dancer/issues/1117","tags":["issue-tracking"],"source":"CPANSec"},{"url":"https://github.com/PerlDancer/Dancer/issues/1118","tags":["issue-tracking"],"source":"CPANSec"},{"url":"https://github.com/PerlDancer/Dancer/pull/1172","tags":["issue-tracking"],"source":"CPANSec"},{"url":"https://metacpan.org/release/BIGPRESH/Dancer-1.3400/changes","tags":["release-notes"],"source":"CPANSec"},{"url":"http://www.openwall.com/lists/oss-security/2026/11/14/15","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-1286","description":"CWE-1286 Improper Validation of Syntactic Correctness of Input","source":"CPANSec"}],"applicability":[],"prioritization":[]},"title":"Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine","titleSource":"CPANSec","descriptionSource":"CPANSec","description":"Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine.\n\nread_session_id returns the cookie value as the session id without checking its characters, and Dancer hands it to the session engine to load the session.\n\nA remote attacker may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query without checking it.","score":null,"severity":"unknown","published":"2026-11-14T20:10:58.771Z","modified":"2026-11-14T23:05:03.050Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"","name":"Dancer","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"1.3400","versionType":"custom"}],"defaultStatus":"unaffected","packageURL":"pkg:cpan/Dancer","cpes":[],"source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2015-10149"}],"remediation":[{"text":"Upgrade to Dancer 1.3400 or later.","source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2015-10149"}],"references":["https://github.com/PerlDancer/Dancer/commit/5a68fddbaef903fd3bd58517ce585cde986716e4.patch","https://github.com/PerlDancer/Dancer/issues/1117","https://github.com/PerlDancer/Dancer/issues/1118","https://github.com/PerlDancer/Dancer/pull/1172","https://metacpan.org/release/BIGPRESH/Dancer-1.3400/changes","http://www.openwall.com/lists/oss-security/2026/11/14/15"],"sources":[{"name":"CVE","id":"CVE-2015-10149","modified":"2026-11-14T23:05:03.050Z","url":"https://www.cve.org/CVERecord?id=CVE-2015-10149"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-11-14T23:15:42.560Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:00:33.565Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-14T20:25:33.192Z","attemptedAt":"2026-11-14T20:25:33.192Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-14T20:25:33.189Z","attemptedAt":"2026-11-14T20:25:33.189Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-14T20:25:33.190Z","attemptedAt":"2026-11-14T20:25:33.190Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-14T20:25:33.191Z","attemptedAt":"2026-11-14T20:25:33.191Z"}],"evidence":[{"source":"NVD","id":"CVE-2015-10149","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-10149","modified":"2026-11-14T20:17:39.203","checkedAt":"2026-11-14T20:25:33.192Z"}],"aiSummary":{"text":"Dancer versions before 1.3400 for Perl pass unvalidated session IDs to the session engine, potentially allowing a remote attacker to cause path traversal or injection. The session ID is not checked for valid characters. This may impact session engines using the ID in file paths or queries.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-14T20:21:03.687Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2015-10149"}]}}