CVE-2013-10031 - Vulnerability Details - OpenCVE

Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Plack Project	Plack

No data.

No data.

References

Link	Providers
https://github.com/plack/Plack-Middleware-Session/commit/b7f0252269ba1bb812b5dc02303754fe94c808e4

History

Thu, 11 Dec 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 09 Dec 2025 10:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Plack Project Plack Project plack
Vendors & Products		Plack Project Plack Project plack

Tue, 09 Dec 2025 00:30:00 +0000

Type	Values Removed	Values Added
Description		Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks
Title		Plack::Middleware::Session versions before 0.17 for Perl may be vulnerable to HMAC comparison timing attacks
Weaknesses		CWE-1254
References		https://github.com/plack/Plack-Middleware-Session/commit/b7f0252269ba1bb812b5dc02303754fe94c808e4

MITRE

Status: PUBLISHED

Assigner: CPANSec

Published: 2025-12-09T00:12:36.372Z

Updated: 2025-12-11T14:36:31.485Z

Reserved: 2025-07-10T09:30:45.910Z

Link: CVE-2013-10031

Vulnrichment

Updated: 2025-12-09T19:53:05.460Z

NVD

Status : Awaiting Analysis

Published: 2025-12-09T01:16:42.587

Modified: 2025-12-11T15:15:45.960

Link: CVE-2013-10031

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2013-10031", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2025-07-10T09:30:45.910Z", "datePublished": "2025-12-09T00:12:36.372Z", "dateUpdated": "2025-12-11T14:36:31.485Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Plack-Middleware-Session", "product": "Plack::Middleware::Session", "programFiles": ["lib/Plack/Middleware/Session/Cookie.pm"], "programRoutines": [{"name": "get_session"}], "repo": "https://github.com/plack/Plack-Middleware-Session.git", "vendor": "MIYAGAWA", "versions": [{"lessThan": "0.17", "status": "affected", "version": "0.01", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks<br>"}], "value": "Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks"}], "impacts": [{"capecId": "CAPEC-26", "descriptions": [{"lang": "en", "value": "CAPEC-26 Leveraging Race Conditions"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1254", "description": "CWE-1254 Incorrect Comparison Logic Granularity", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2025-12-09T00:12:36.372Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/plack/Plack-Middleware-Session/commit/b7f0252269ba1bb812b5dc02303754fe94c808e4"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade to version 0.17 or higher"}], "value": "Upgrade to version 0.17 or higher"}], "source": {"discovery": "UNKNOWN"}, "title": "Plack::Middleware::Session versions before 0.17 for Perl may be vulnerable to HMAC comparison timing attacks", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-12-09T19:53:02.755963Z", "id": "CVE-2013-10031", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-11T14:36:31.485Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2013-10031", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-09T19:53:02.755963Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T19:53:05.460Z"}}], "cna": {"title": "Plack::Middleware::Session versions before 0.17 for Perl may be vulnerable to HMAC comparison timing attacks", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-26", "descriptions": [{"lang": "en", "value": "CAPEC-26 Leveraging Race Conditions"}]}], "affected": [{"repo": "https://github.com/plack/Plack-Middleware-Session.git", "vendor": "MIYAGAWA", "product": "Plack::Middleware::Session", "versions": [{"status": "affected", "version": "0.01", "lessThan": "0.17", "versionType": "custom"}], "packageName": "Plack-Middleware-Session", "programFiles": ["lib/Plack/Middleware/Session/Cookie.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "get_session"}]}], "solutions": [{"lang": "en", "value": "Upgrade to version 0.17 or higher", "supportingMedia": [{"type": "text/html", "value": "Upgrade to version 0.17 or higher", "base64": false}]}], "references": [{"url": "https://github.com/plack/Plack-Middleware-Session/commit/b7f0252269ba1bb812b5dc02303754fe94c808e4", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks", "supportingMedia": [{"type": "text/html", "value": "Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1254", "description": "CWE-1254 Incorrect Comparison Logic Granularity"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2025-12-09T00:12:36.372Z"}}}, "cveMetadata": {"cveId": "CVE-2013-10031", "state": "PUBLISHED", "dateUpdated": "2025-12-11T14:36:31.485Z", "dateReserved": "2025-07-10T09:30:45.910Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2025-12-09T00:12:36.372Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}