{"id":"CVE-2015-10149","kind":"vulnerability","aliases":["CVE-2015-10149"],"related":[],"title":"Dancer for Perl: unchecked session cookie ids can reach session storage","description":"Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine.\n\nread_session_id returns the cookie value as the session id without checking its characters, and Dancer hands it to the session engine to load the session.\n\nA remote attacker may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query without checking it.","summary":"Dancer versions before 1.3400 for Perl take the session id from the session cookie without checking its characters and pass it to the session engine. A remote attacker who sets the cookie may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dancer","package","perl","web-apps"],"not_affected_if":["managed-hosting","no-sessions"],"how_to_check":"- Check the installed Dancer version with `perl -MDancer -e 'print $Dancer::VERSION'`\n- Look for session engines in the app config that store sessions as files, in a cache, or in a database\n- Check whether session cookies are read by the app without validation","fix":"- Dancer: `1.3400` or later (per the sources, the fix is in versions before 1.3400 being affected)","status":"open","published_at":"2026-11-14T20:17:39+00:00","first_seen_at":"2026-11-14T20:33:12+00:00","triaged_at":"2026-11-14T20:35:12+00:00","updated_at":"2026-11-14T20:35:12+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-14T20:35:12Z","model":"claude-haiku-5-5","output":{"fix":"- Dancer: `1.3400` or later (per the sources, the fix is in versions before 1.3400 being affected)","reach":"internet","title":"Dancer for Perl: unchecked session cookie ids can reach session storage","impact":"medium","summary":"Dancer versions before 1.3400 for Perl take the session id from the session cookie without checking its characters and pass it to the session engine. A remote attacker who sets the cookie may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","dancer","web-apps"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker reaches files or session store via crafted cookie","analyst_note":"Confirm the exact fixed version and which session engines are exploitable against the Patch link (github.com).","how_to_check":"- Check the installed Dancer version with `perl -MDancer -e 'print $Dancer::VERSION'`\n- Look for session engines in the app config that store sessions as files, in a cache, or in a database\n- Check whether session cookies are read by the app without validation","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-sessions","managed-hosting"],"who_is_affected":"Perl web applications built on Dancer that use a session engine which builds a file path, cache command or query from the session id. Apps that do not use sessions, or that use a session engine that does not take the id from the cookie unchecked, are less exposed. The sources do not say which session engines are unsafe.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000749,"input_tokens":4579,"output_tokens":582,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-10149':14A,17A '-2015':13A,16A '1.3400':27B,81C 'app':23B 'attack':51B,125C 'cach':74B,144C 'caus':57B,127C 'charact':41B,110C 'check':39B,108C,149C 'command':75B,145C 'cooki':6A,37B,55B,91C,101C 'cve':12A,15A 'dancer':1A,18B,24B,78C,112C 'engin':48B,65B,95C,118C,135C 'file':72B,142C 'hand':113C 'id':7A,33B,69B,87C,98C,106C,139C 'inject':61B,131C 'load':120C 'may':56B,126C 'packag':19B 'pass':43B,84C 'path':58B,73B,128C,143C 'perl':3A,20B,29B,83C 'queri':77B,147C 'reach':9A 'read':96C 'remot':50B,124C 'return':99C 'session':5A,10A,32B,36B,47B,64B,86C,90C,94C,97C,105C,117C,122C,134C 'set':53B 'storag':11A 'take':30B 'travers':59B,129C 'uncheck':4A 'unvalid':85C 'use':67B,137C 'valu':102C 'version':25B,79C 'web':22B 'web-app':21B 'without':38B,107C,148C","nicknames":[],"mitigations":[],"who_affected":"Perl web applications built on Dancer that use a session engine which builds a file path, cache command or query from the session id. Apps that do not use sessions, or that use a session engine that does not take the id from the cookie unchecked, are less exposed. The sources do not say which session engines are unsafe.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dancer","package","perl","unknown","webapps"],"campaign_type":null,"search_a":"'-10149':14A,17A '-2015':13A,16A 'cooki':6A 'cve':12A,15A 'dancer':1A 'id':7A 'perl':3A 'reach':9A 'session':5A,10A 'storag':11A 'uncheck':4A","search_b":"'1.3400':27B 'app':23B 'attack':51B 'cach':74B 'caus':57B 'charact':41B 'check':39B 'command':75B 'cooki':37B,55B 'dancer':18B,24B 'engin':48B,65B 'file':72B 'id':33B,69B 'inject':61B 'may':56B 'packag':19B 'pass':43B 'path':58B,73B 'perl':20B,29B 'queri':77B 'remot':50B 'session':32B,36B,47B,64B 'set':53B 'take':30B 'travers':59B 'use':67B 'version':25B 'web':22B 'web-app':21B 'without':38B","search_c":"'1.3400':81C 'attack':125C 'cach':144C 'caus':127C 'charact':110C 'check':108C,149C 'command':145C 'cooki':91C,101C 'dancer':78C,112C 'engin':95C,118C,135C 'file':142C 'hand':113C 'id':87C,98C,106C,139C 'inject':131C 'load':120C 'may':126C 'pass':84C 'path':128C,143C 'perl':83C 'queri':147C 'read':96C 'remot':124C 'return':99C 'session':86C,90C,94C,97C,105C,117C,122C,134C 'travers':129C 'unvalid':85C 'use':137C 'valu':102C 'version':79C 'without':107C,148C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T20:17:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2015-10149","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-10149","severity":null,"published_at":"2026-11-14T20:17:39+00:00","modified_at":"2026-11-14T20:17:39+00:00","first_seen_at":"2026-11-14T20:33:12+00:00","fetched_at":"2026-11-14T20:33:12+00:00","note":null}],"documents":[{"id":158245,"url":"https://github.com/PerlDancer/Dancer/commit/5a68fddbaef903fd3bd58517ce585cde986716e4.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}