CVE-2013-10075 - Vulnerability Details - OpenCVE

Apache::Session versions through 1.94 for Perl re-creates deleted sessions. The session stores Apache::Session::Store::File and Apache::Session::Store::DB_File will create a session that does not exist. This can lead to sessions being revived, potentially with data that was to be deleted.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Chorny	Apache\

Configuration 1 [-]

cpe:2.3:a:chorny:apache\:\:session:*:*:*:*:*:perl:*:*

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/05/08/12
https://rt.cpan.org/Public/Bug/Display.html?id=83525

History

Fri, 08 May 2026 20:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Chorny Chorny apache\
CPEs		cpe:2.3:a:chorny:apache\:\:session::::::perl::*
Vendors & Products		Chorny Chorny apache\

Fri, 08 May 2026 18:30:00 +0000

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/05/08/12

Fri, 08 May 2026 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 08 May 2026 08:15:00 +0000

Type	Values Removed	Values Added
Description		Apache::Session versions through 1.94 for Perl re-creates deleted sessions. The session stores Apache::Session::Store::File and Apache::Session::Store::DB_File will create a session that does not exist. This can lead to sessions being revived, potentially with data that was to be deleted.
Title		Apache::Session versions through 1.94 for Perl re-creates deleted sessions
Weaknesses		CWE-672
References		https://rt.cpan.org/Public/Bug/Display.html?id=83525

MITRE

Status: PUBLISHED

Assigner: CPANSec

Published: 2026-05-08T07:44:13.267Z

Updated: 2026-05-08T17:58:32.010Z

Reserved: 2026-04-20T11:38:29.675Z

Link: CVE-2013-10075

Vulnrichment

Updated: 2026-05-08T17:30:40.975Z

NVD

Status : Analyzed

Published: 2026-05-08T08:16:43.463

Modified: 2026-05-08T19:51:16.810

Link: CVE-2013-10075

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2013-10075", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-04-20T11:38:29.675Z", "datePublished": "2026-05-08T07:44:13.267Z", "dateUpdated": "2026-05-08T17:58:32.010Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Apache-Session", "product": "Apache::Session", "programFiles": ["lib/Apache/Session.pm"], "programRoutines": [{"name": "Apache::Session::save"}], "repo": "http://github.com/chorny/Apache-Session", "vendor": "CHORNY", "versions": [{"lessThanOrEqual": "1.94", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Thomas Sibley"}], "descriptions": [{"lang": "en", "value": "Apache::Session versions through 1.94 for Perl re-creates deleted sessions.\n\nThe session stores Apache::Session::Store::File and Apache::Session::Store::DB_File will create a session that does not exist. This can lead to sessions being revived, potentially with data that was to be deleted."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-672", "description": "CWE-672 Operation on a Resource after Expiration or Release", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-05-08T07:44:13.267Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://rt.cpan.org/Public/Bug/Display.html?id=83525"}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2013-02-21T00:00:00.000Z", "value": "Issue reported"}], "title": "Apache::Session versions through 1.94 for Perl re-creates deleted sessions", "workarounds": [{"lang": "en", "value": "Use a database store based on Apache::Session::Store::DBI."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/05/08/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-08T17:30:40.975Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-05-08T17:58:26.345322Z", "id": "CVE-2013-10075", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T17:58:32.010Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/05/08/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-08T17:30:40.975Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2013-10075", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-08T17:58:26.345322Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T17:58:21.549Z"}}], "cna": {"title": "Apache::Session versions through 1.94 for Perl re-creates deleted sessions", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Thomas Sibley"}], "affected": [{"repo": "http://github.com/chorny/Apache-Session", "vendor": "CHORNY", "product": "Apache::Session", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.94"}], "packageName": "Apache-Session", "programFiles": ["lib/Apache/Session.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Apache::Session::save"}]}], "timeline": [{"lang": "en", "time": "2013-02-21T00:00:00.000Z", "value": "Issue reported"}], "references": [{"url": "https://rt.cpan.org/Public/Bug/Display.html?id=83525", "tags": ["issue-tracking"]}], "workarounds": [{"lang": "en", "value": "Use a database store based on Apache::Session::Store::DBI."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Apache::Session versions through 1.94 for Perl re-creates deleted sessions.\n\nThe session stores Apache::Session::Store::File and Apache::Session::Store::DB_File will create a session that does not exist. This can lead to sessions being revived, potentially with data that was to be deleted."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-672", "description": "CWE-672 Operation on a Resource after Expiration or Release"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-05-08T07:44:13.267Z"}}}, "cveMetadata": {"cveId": "CVE-2013-10075", "state": "PUBLISHED", "dateUpdated": "2026-05-08T17:58:32.010Z", "dateReserved": "2026-04-20T11:38:29.675Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-05-08T07:44:13.267Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}