CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.62.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
CallBackery, a Perl web application framework, is affected in versions before 0.62.0. An attacker who obtains an old session cookie, such as one leaked through logs, Referer headers, or browser history, can reuse it indefinitely by sending it in the X-Session-Cookie header, because the age limit that applies to the xsc query parameter is not enforced for that header.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cookieConf() rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is. A session cookie that leaks through a log, a Referer header or browser history authenticates as its user indefinitely.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- CallBackery
fixed in 0.62.0