CVE-2013-10075 -- CVSS 9.1 Vulnerability Briefing

CVE-2013-10075 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2013-10075 is a session management vulnerability in Apache::Session versions through 1.94 for Perl, specifically affecting the Apache::Session::Store::File and Apache::Session::Store::DB_File storage backends, which incorrectly recreate deleted sessions.

Technical Detail

The flaw exists in how the File and DB_File session store backends handle session deletion: when a session is deleted, subsequent access attempts using the deleted session identifier cause the store to recreate the session rather than reject it. An attacker who retains a previously invalidated session token can reuse it to regain an authenticated session context, effectively bypassing session invalidation controls. The practical impact is an authentication bypass, allowing unauthorized access to application resources that depend on session termination as a security boundary, such as logout operations or administrative session revocation.

Exploitation Status

No known exploit code has been publicly identified for this vulnerability, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit at this time. Despite the high CVSS score of 9.1, there is no confirmed evidence of active exploitation in the wild as of this writing.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability in available intelligence sources.

What To Do

Operators running Perl applications that use Apache::Session should upgrade to a version of the module released after 1.94, which addresses the session recreation behavior. If an immediate upgrade is not feasible, a compensating control is to implement application-level session token rotation and server-side session invalidation checks that do not rely solely on the store backend's deletion behavior. Developers should audit any logout or session revocation logic to confirm that invalidated tokens are explicitly rejected at the application layer. Given the age of this CVE and the lack of known active exploitation, patching should be prioritized within normal patch cycle timelines rather than treated as an emergency, though any internet-facing Perl application using this module warrants prompt attention.