{"metadata": {"vulnerability": "CVE-2015-10149", "count": 17, "kinds": {"milestone": 3, "sighting": 3, "kev": 0, "other": 11}, "linked_omitted": 0}, "data": [{"timestamp": "2015-06-03T00:00:00Z", "date_only": false, "value": "2015-06-03T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / CPANSec", "record": "CVE-2015-10149", "field": "containers.cna.timeline.0.time", "text": "Session id validation vulnerability first reported in issue 1117."}, {"timestamp": "2016-02-15T00:00:00Z", "date_only": false, "value": "2016-02-15T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / CPANSec", "record": "CVE-2015-10149", "field": "containers.cna.timeline.1.time", "text": "Dancer version 1.3300 adds session id validation."}, {"timestamp": "2016-02-16T00:00:00Z", "date_only": false, "value": "2016-02-16T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / CPANSec", "record": "CVE-2015-10149", "field": "containers.cna.timeline.2.time", "text": "Dancer version 1.3301 reverts session id changes that broke Dancer::Session::Cookie."}, {"timestamp": "2018-02-04T00:00:00Z", "date_only": false, "value": "2018-02-04T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / CPANSec", "record": "CVE-2015-10149", "field": "containers.cna.timeline.3.time", "text": "Pull request 1172 with session id validation created,"}, {"timestamp": "2018-05-20T00:00:00Z", "date_only": false, "value": "2018-05-20T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / CPANSec", "record": "CVE-2015-10149", "field": "containers.cna.timeline.4.time", "text": "Dancer version 1.3203 released with session id validation."}, {"timestamp": "2018-06-15T00:00:00Z", "date_only": false, "value": "2018-06-15T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / CPANSec", "record": "CVE-2015-10149", "field": "containers.cna.timeline.5.time", "text": "Dancer version 1.3400 released that promotes previous trial releases to stable release."}, {"timestamp": "2026-11-14T19:54:01.601Z", "date_only": false, "value": "2026-11-14T19:54:01.601Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2015-10149", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-14T20:10:58.771Z", "date_only": false, "value": "2026-11-14T20:10:58.771Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2015-10149", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-14T20:10:58.771Z", "date_only": false, "value": "2026-11-14T20:10:58.771Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CPANSec", "record": "CVE-2015-10149", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-14T20:16:39.278Z", "date_only": false, "value": "2026-11-14T20:16:39.278904Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117616633363648270", "record": "CVE-2015-10149", "field": "creation_timestamp", "uuid": "b0f56bf2-c6a0-4306-9050-d99c1fce29eb", "content": "CVE-2015-10149 Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine.\nread_session_id returns the cookie value as the session id without checking its characters, and Dancer hands it to the session engine to load the session.\nA remote attacker may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query without checking it.\nhttps://www.cve.org/CVERecord?id=CVE-2015-10149https://github.com/PerlDancer/Dancer/commit/5a68fddbaef903fd3bd58517ce585cde986716e4.patchhttps://github.com/PerlDancer/Dancer/issues/1117https://github.com/PerlDancer/Dancer/issues/1118https://github.com/PerlDancer/Dancer/pull/1172https://metacpan.org/release/BIGPRESH/Dancer-1.3400/changes#CVE_2015_10149#bot", "url": "https://infosec.exchange/users/cve/statuses/117616633363648270"}, {"timestamp": "2026-11-14T20:17:39Z", "date_only": false, "value": "2026-11-14T20:17:39Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-3M7F-5M7R-G968", "record": "GHSA-3M7F-5M7R-G968", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-14T20:58:01.067Z", "date_only": false, "value": "2026-11-14T20:58:01.067898Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/2ofckiybmeptp", "record": "CVE-2015-10149", "field": "creation_timestamp", "uuid": "d3bdcd9b-a9b8-4c65-9451-3109474941f6", "content": "CVE-2015-10149: Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/2ofckiybmeptp"}, {"timestamp": "2026-11-14T21:31:47Z", "date_only": false, "value": "2026-11-14T21:31:47Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-3M7F-5M7R-G968", "record": "GHSA-3M7F-5M7R-G968", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-14T21:31:47Z", "date_only": false, "value": "2026-11-14T21:31:47Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-3M7F-5M7R-G968", "record": "GHSA-3M7F-5M7R-G968", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-14T22:38:28.123Z", "date_only": false, "value": "2026-11-14T22:38:28.123909Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5b6jnzncnkbu3", "record": "CVE-2015-10149", "field": "creation_timestamp", "uuid": "9df62336-21c7-4fe5-9bee-6aa4b7bbf996", "content": "CVE-2015-10149 - Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine\nCVE ID : CVE-2015-10149\n \n Published : Nov. 14, 2026, 8:17 p.m. | 1\u00a0hour, 59\u00a0minutes ago\n \n Description : Dancer versions before 1.3400 for Perl p...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/5b6jnzncnkbu3"}, {"timestamp": "2026-11-14T23:05:03.050Z", "date_only": false, "value": "2026-11-14T23:05:03.050Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2015-10149", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-14T23:05:03.050Z", "date_only": false, "value": "2026-11-14T23:05:03.050Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2015-10149", "field": "containers.adp.0.providerMetadata.dateUpdated"}], "metrics": {"as_of": "2026-11-15T00:02:26.731Z", "anchors": {"origin": {"timestamp": "2026-11-14T20:10:58.771Z", "date_only": false, "value": "2026-11-14T20:10:58.771Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2015-10149", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-14T20:10:58.771Z", "date_only": false, "value": "2026-11-14T20:10:58.771Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2015-10149", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 13887.960748, "hours": 3.857766874444444, "days": 0.16074028643518518, "min_seconds": 13887.960748, "max_seconds": 13887.960748, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-14T20:10:58.771Z", "date_only": false, "value": "2026-11-14T20:10:58.771Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2015-10149", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-15T00:02:26.731Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}