{"api_version":"1","generated_at":"2026-11-14T23:50:19+00:00","cve":"CVE-2015-10149","urls":{"html":"https://cve.report/CVE-2015-10149","api":"https://cve.report/api/cve/CVE-2015-10149.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-10149","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-10149"},"summary":{"title":"Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine","description":"Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine.\n\nread_session_id returns the cookie value as the session id without checking its characters, and Dancer hands it to the session engine to load the session.\n\nA remote attacker may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query without checking it.","state":"PUBLISHED","assigner":"CPANSec","published_at":"2026-11-14 20:17:39","updated_at":"2026-11-14 23:16:46"},"problem_types":["CWE-1286","CWE-1286 CWE-1286 Improper Validation of Syntactic Correctness of Input"],"metrics":[],"references":[{"url":"https://github.com/PerlDancer/Dancer/issues/1117","name":"https://github.com/PerlDancer/Dancer/issues/1117","refsource":"9b29abf9-4ab0-4765-b253-1875cd9b441e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/PerlDancer/Dancer/issues/1118","name":"https://github.com/PerlDancer/Dancer/issues/1118","refsource":"9b29abf9-4ab0-4765-b253-1875cd9b441e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://metacpan.org/release/BIGPRESH/Dancer-1.3400/changes","name":"https://metacpan.org/release/BIGPRESH/Dancer-1.3400/changes","refsource":"9b29abf9-4ab0-4765-b253-1875cd9b441e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/PerlDancer/Dancer/pull/1172","name":"https://github.com/PerlDancer/Dancer/pull/1172","refsource":"9b29abf9-4ab0-4765-b253-1875cd9b441e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://www.openwall.com/lists/oss-security/2026/11/14/15","name":"http://www.openwall.com/lists/oss-security/2026/11/14/15","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/PerlDancer/Dancer/commit/5a68fddbaef903fd3bd58517ce585cde986716e4.patch","name":"https://github.com/PerlDancer/Dancer/commit/5a68fddbaef903fd3bd58517ce585cde986716e4.patch","refsource":"9b29abf9-4ab0-4765-b253-1875cd9b441e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-10149","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-10149","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[{"source":"CNA","time":"2015-06-03T00:00:00.000Z","lang":"en","value":"Session id validation vulnerability first reported in issue 1117."},{"source":"CNA","time":"2016-02-15T00:00:00.000Z","lang":"en","value":"Dancer version 1.3300 adds session id validation."},{"source":"CNA","time":"2016-02-16T00:00:00.000Z","lang":"en","value":"Dancer version 1.3301 reverts session id changes that broke Dancer::Session::Cookie."},{"source":"CNA","time":"2018-02-04T00:00:00.000Z","lang":"en","value":"Pull request 1172 with session id validation created,"},{"source":"CNA","time":"2018-05-20T00:00:00.000Z","lang":"en","value":"Dancer version 1.3203 released with session id validation."},{"source":"CNA","time":"2018-06-15T00:00:00.000Z","lang":"en","value":"Dancer version 1.3400 released that promotes previous trial releases to stable release."}],"solutions":[{"source":"CNA","title":"","value":"Upgrade to Dancer 1.3400 or later.","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2026-11-14T23:05:03.050Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"http://www.openwall.com/lists/oss-security/2026/11/14/15"}],"title":"CVE Program Container"}],"cna":{"affected":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["Dancer"],"packageName":"Dancer","packageURL":"pkg:cpan/Dancer","programFiles":["lib/Dancer/Session/Abstract.pm"],"programRoutines":[{"name":"Dancer::Session::Abstract::read_session_id"}],"repo":"https://github.com/PerlDancer/Dancer","versions":[{"lessThan":"1.3400","status":"affected","version":"0","versionType":"custom"}]}],"descriptions":[{"lang":"en","value":"Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine.\n\nread_session_id returns the cookie value as the session id without checking its characters, and Dancer hands it to the session engine to load the session.\n\nA remote attacker may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query without checking it."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1286","description":"CWE-1286 Improper Validation of Syntactic Correctness of Input","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-14T20:10:58.771Z","orgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","shortName":"CPANSec"},"references":[{"tags":["patch"],"url":"https://github.com/PerlDancer/Dancer/commit/5a68fddbaef903fd3bd58517ce585cde986716e4.patch"},{"tags":["issue-tracking"],"url":"https://github.com/PerlDancer/Dancer/issues/1117"},{"tags":["issue-tracking"],"url":"https://github.com/PerlDancer/Dancer/issues/1118"},{"tags":["issue-tracking"],"url":"https://github.com/PerlDancer/Dancer/pull/1172"},{"tags":["release-notes"],"url":"https://metacpan.org/release/BIGPRESH/Dancer-1.3400/changes"}],"solutions":[{"lang":"en","value":"Upgrade to Dancer 1.3400 or later."}],"source":{"discovery":"UNKNOWN"},"timeline":[{"lang":"en","time":"2015-06-03T00:00:00.000Z","value":"Session id validation vulnerability first reported in issue 1117."},{"lang":"en","time":"2016-02-15T00:00:00.000Z","value":"Dancer version 1.3300 adds session id validation."},{"lang":"en","time":"2016-02-16T00:00:00.000Z","value":"Dancer version 1.3301 reverts session id changes that broke Dancer::Session::Cookie."},{"lang":"en","time":"2018-02-04T00:00:00.000Z","value":"Pull request 1172 with session id validation created,"},{"lang":"en","time":"2018-05-20T00:00:00.000Z","value":"Dancer version 1.3203 released with session id validation."},{"lang":"en","time":"2018-06-15T00:00:00.000Z","value":"Dancer version 1.3400 released that promotes previous trial releases to stable release."}],"title":"Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine","x_generator":{"engine":"cpansec-cna-tool 0.1"}}},"cveMetadata":{"assignerOrgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","assignerShortName":"CPANSec","cveId":"CVE-2015-10149","datePublished":"2026-11-14T20:10:58.771Z","dateReserved":"2026-11-14T19:54:01.601Z","dateUpdated":"2026-11-14T23:05:03.050Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-14 20:17:39","lastModifiedDate":"2026-11-14 23:16:46","problem_types":["CWE-1286","CWE-1286 CWE-1286 Improper Validation of Syntactic Correctness of Input"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"10149","Ordinal":"1","Title":"Dancer versions before 1.3400 for Perl pass unvalidated session ","CVE":"CVE-2015-10149","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"10149","Ordinal":"1","NoteData":"Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine.\n\nread_session_id returns the cookie value as the session id without checking its characters, and Dancer hands it to the session engine to load the session.\n\nA remote attacker may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query without checking it.","Type":"Description","Title":"Dancer versions before 1.3400 for Perl pass unvalidated session "}]}}}