CVE-2012-6142 Session::Cookie in the HTML::EP module 0.2011 for Perl does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via a crafted request, which is not pr...

HighCVSS 7.5 EPSS 2.7%

Published: 2014-06-05 02:00
Updated: 2026-06-17 02:47
Exploit status: No public exploit known

Description

Session::Cookie in the HTML::EP module 0.2011 for Perl does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via a crafted request, which is not properly handled when it is deserialized.

Affected products

Product	Affected versions	Fixed in
jochen wiedmann htmlep	= 0.2011	No fix listed

References

[oss-security] 20130514 Re: CVE Request: Storable::thaw called on cookie data in multiple CPAN modules mailing-list
59833 vdb-entry
htmlep-cve20126142-sec-bypass(84199) vdb-entry

CVSS v2.0

7.5 High

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Weakness & likelihood

EPSS (exploitation probability, 30 days): 2.72% (percentile 86.2)
CWE: CWE-94

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.