Apache::Session versions through 1.94 for Perl re-creates deleted sessions. The session stores Apache::Session::Store::File and Apache::Session::Store::DB_File will create a session that does not exist. This can lead to sessions being revived, potentially with data that was to be deleted.
The session storage mechanism in Apache::Session::Store::File and Apache::Session::Store::DB_File backends improperly handles requests for non-existent sessions — instead of returning an error, it creates a new session with the provided identifier. As a result, an attacker or application can reactivate a session identifier that should have been permanently deleted. The session can be restored along with data that was supposed to be permanently erased (CWE-672: operation performed after resource expiration).
An attacker can gain unauthorized access to data associated with a deleted session (confidentiality breach) or manipulate application state by reusing invalidated session identifiers (integrity breach).
Apply patches available from the vendor according to references. It is recommended to update the Apache::Session library to a version higher than 1.94 as soon as it is released by the module author on CPAN. Until the update is available, consider implementing additional verification on the application side to confirm that a session with a given identifier actually exists before using it.
Apache::Session for Perl in versions up to and including 1.94, using Apache::Session::Store::File or Apache::Session::Store::DB_File backends.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NChorny Apache\
APPChorny\