CVE-2009-10007
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A vulnerability in the Catalyst::Plugin::Authentication library for Perl before version 0.10_027 allows session fixation attacks. The library does not automatically change the session ID after authentication, enabling an attacker to hijack the victim's session.
Risk Assessment
An attacker can exploit a fixed session ID to impersonate an authenticated user, leading to unauthorized access to accounts and data.
Recommendation
Update the Catalyst::Plugin::Authentication library to version 0.10_027 or later, which automatically changes the session ID after successful login.
Original NVD description (English source)
Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks. Catalyst::Plugin::Authentication does not automatically change the session id after authentication. An attacker that obtains a session id cookie can use this to impersonate the victim.