CVE-2018-25160 - CVE House
Back to Database
Status published Unknown CVE-2018-25160

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend

Vulnerability Description

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend. For example, if an application uses memcached for session storage, then it may be possible for a remote attacker to inject memcached commands in the session id value.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-25160

Credits & Attribution

No credits recorded in the NVD database.

References

More from TOKUHIROM

View All →
CVE-2025-15604
Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions
Unknown 0

Affected Vendor

Affected Software

HTTP::Session2
Vulnerable Versions:
0

Timeline

Official Publish: February 27th, 2026
Last Modified: March 3rd, 2026
Added to House: July 20th, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

CWE-20

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact