The session stores Apache::Session::Store::File and Apache::Session::Store::DB_File will create a session that does not exist. This can lead to sessions being revived, potentially with data that was to be deleted.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| CHORNY | Apache::Session | unaffected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
Use a database store based on Apache::Session::Store::DBI.
| Link | Providers |
|---|---|
| https://rt.cpan.org/Public/Bug/Display.html?id=83525 |
|
Fri, 08 May 2026 08:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Apache::Session versions through 1.94 for Perl re-creates deleted sessions. The session stores Apache::Session::Store::File and Apache::Session::Store::DB_File will create a session that does not exist. This can lead to sessions being revived, potentially with data that was to be deleted. | |
| Title | Apache::Session versions through 1.94 for Perl re-creates deleted sessions | |
| Weaknesses | CWE-672 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-05-08T07:44:13.267Z
Reserved: 2026-04-20T11:38:29.675Z
Link: CVE-2013-10075
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-05-08T08:16:43.463
Modified: 2026-05-08T08:16:43.463
Link: CVE-2013-10075
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-05-08T09:30:05Z