CVE-2013-10075

CriticalCVSS 9.1/10Last modified Jun 16, 2026

Description

Apache::Session versions through 1.94 for Perl re-creates deleted sessions.

The session stores Apache::Session::Store::File and Apache::Session::Store::DB_File will create a session that does not exist. This can lead to sessions being revived, potentially with data that was to be deleted.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-672

Affected software

Vendor	Product	Versions
CHORNY	Apache::Session	<= 1.94

References

https://rt.cpan.org/Public/Bug/Display.html?id=83525Issue Tracking, Mailing List
http://www.openwall.com/lists/oss-security/2026/05/08/12Mailing List, Third Party Advisory

Timeline

Published: May 8, 2026
Last modified: Jun 16, 2026
NVD status: Analyzed

Related CVEs from 2013

CVE-2013-100767.5ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend(CVE-2013-100775.3A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py o CVE-2013-10089.3WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (me CVE-2013-10096.8WebKit, as used in Apple Safari before 6.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupt CVE-2013-10109.3WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (me CVE-2013-10116.8WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (me CVE-2013-10124.3Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 6.0.5 allows remote attackers to inject arbitrary web script or HT CVE-2013-10134.3XSS Auditor in WebKit in Apple Safari before 6.0.5 does not properly rewrite URLs, which allows remote attackers to trigger unintended form CVE-2013-10144.3Apple iTunes before 11.0.3 does not properly verify X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via CVE-2013-10159.3Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafte CVE-2013-10169.3Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application CVE-2013-10179.3Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application