CVE catalog

CVE-2009-10007

Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks. Catalyst::Plugin::Authentication does not automatically change the session id after auth

[CVE catalog]

Severity
Critical · CVSS 9.1
Published
Source
[NVD] · [CVE record]
EPSS
0.37% · Oct 25, 2026

Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks. Catalyst::Plugin::Authentication does not automatically change the session id after authentication. An attacker that obtains a session id cookie can use this to impersonate the victim.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibcatalyst-plugin-authentication-perlsid0.10028-1fixed
Debianlibcatalyst-plugin-authentication-perlforky0.10028-1fixed
Debianlibcatalyst-plugin-authentication-perltrixie0.10024-1vulnerable
Debianlibcatalyst-plugin-authentication-perlbookworm0.10023-4vulnerable
Cpelibcatalyst-plugin-authentication-perlNot reportedNot reportedvulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibcatalyst-plugin-authentication-perlsourcesid0.10028-1not yet assignedNot reported[1139461]
Debianlibcatalyst-plugin-authentication-perlsourceforky0.10028-1not yet assignedNot reported[1139461]
Debianlibcatalyst-plugin-authentication-perlsourcetrixie(unfixed)not yet assignedNot reported[1139461]
Debianlibcatalyst-plugin-authentication-perlsourcebookworm(unfixed)not yet assignedNot reported[1139461]

[Debian bug #1139461]

Notes

[trixie] libcatalyst-plugin-authentication-perl: Minor issue [bookworm] libcatalyst-plugin-authentication-perl: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libcatalyst-plugin-authentication-perl]Affected
    Details (2)

    • 0.10023-4 · all · bookworm

      Affected

      nvd · libcatalyst-plugin-authentication-perl · debian · bookworm; nvd · libcatalyst-plugin-authentication-perl · debian · 12

    • 0.10023-4 · all · bookworm

      Affected

      nvd · libcatalyst-plugin-authentication-perl · debian · bookworm; nvd · libcatalyst-plugin-authentication-perl · debian · 12

[Debian 13 (Trixie)]

  • [libcatalyst-plugin-authentication-perl]Affected
    Details (2)

    • 0.10024-1 · all · trixie

      Affected

      nvd · libcatalyst-plugin-authentication-perl · debian · 13

    • 0.10024-1 · all · trixie

      Affected

      nvd · libcatalyst-plugin-authentication-perl · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]