The App::Context module 0.01 through 0.968 for Perl does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via a crafted request to (1) App::Session::Cookie or (2) App::Session::HTMLHidden, which is not properly handled when it is deserialized.
CVSS 2.0
Severity: HIGH
Problem Type: CWE-94,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| stephen_adkins | app::context | 0.964 |
| stephen_adkins | app::context | 0.967 |
| stephen_adkins | app::context | 0.961 |
| stephen_adkins | app::context | 0.965 |
| stephen_adkins | app::context | 0.95 |
| stephen_adkins | app::context | 0.968 |
| stephen_adkins | app::context | 0.966 |
| stephen_adkins | app::context | 0.962 |
| stephen_adkins | app::context | 0.963 |
| stephen_adkins | app::context | 0.93 |
| stephen_adkins | app::context | 0.01 |
| stephen_adkins | app::context | 0.96 |
| stephen_adkins | app::context | 0.9661 |