CVE-2009-10007
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A vulnerability in the Catalyst::Plugin::Authentication library for Perl before version 0.10_027 allows session fixation attacks. The library does not automatically change the session ID after authentication, enabling an attacker to hijack the victim's session.
Risk Assessment
An attacker can exploit a fixed session ID to impersonate an authenticated user, leading to unauthorized access to accounts and data.
Recommendation
Update the Catalyst::Plugin::Authentication library to version 0.10_027 or later, which automatically changes the session ID after successful login.
Other vulnerabilities in Catalyst::Plugin::Authentication
See all- CVE-2026-74846Low risk· EPSS 20%
Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.
- CVE-2026-5091Medium
Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash or password.
Original NVD description (English source)
Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks. Catalyst::Plugin::Authentication does not automatically change the session id after authentication. An attacker that obtains a session id cookie can use this to impersonate the victim.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS