{"id":"CVE-2017-1000053","aliases":["EUVD-2022-1640","GHSA-5v4m-c73v-c7gq"],"status":"published","title":"Arbitrary Code Execution in Cookie Serialization","description":"Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01934,"percentile":0.80172,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2017-07-13T20:00:00Z","modified":"2026-10-24T10:30:38Z","fixes":[{"ecosystem":"Hex","package":"plug","fixed_in":["1.0.4","1.1.7","1.2.3","1.3.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Hex","package":"plug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4"}]}]},{"source":"ghsa","ecosystem":"Hex","package":"plug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.7"}]}]},{"source":"ghsa","ecosystem":"Hex","package":"plug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.3"}]}]},{"source":"ghsa","ecosystem":"Hex","package":"plug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.3.2"}]}]},{"source":"osv","ecosystem":"Hex","package":"plug","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.4"}]}],"versions":["0.10.0","0.11.0","0.11.1","0.11.2","0.11.3","0.12.0","0.12.1","0.12.2","0.13.0","0.13.1","0.14.0","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.5.1","0.5.2","0.5.3","0.6.0","0.7.0","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9.0","1.0.0","1.0.1","1.0.2","1.0.3"]},{"source":"osv","ecosystem":"Hex","package":"plug","ranges":[{"type":"SEMVER","events":[{"introduced":"1.1.0"},{"fixed":"1.1.7"}]}],"versions":["1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6"]},{"source":"osv","ecosystem":"Hex","package":"plug","ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.0"},{"fixed":"1.2.3"}]}],"versions":["1.2.0","1.2.1","1.2.2"]},{"source":"osv","ecosystem":"Hex","package":"plug","ranges":[{"type":"SEMVER","events":[{"introduced":"1.3.0"},{"fixed":"1.3.2"}]}],"versions":["1.3.0","1.3.1"]}],"products":[{"vendor":"plug_project","product":"plug"}],"references":[{"url":"https://elixirforum.com/t/security-releases-for-plug/3913","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000053","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5v4m-c73v-c7gq"},{"url":"https://github.com/elixir-plug/plug","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2017-1000053","description":"Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session.","status":"published","published":"2017-07-13T20:00:00Z","modified":"2024-08-05T21:53:06.256Z","updated_at":"2026-11-02T14:33:20.843976Z"}],"euvd":[{"id":"EUVD-2022-1640","description":"Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session.","status":"published","published":"2017-07-13T20:00:00Z","modified":"2024-08-05T21:53:06Z","updated_at":"2026-11-03T02:23:03.593375Z"}],"ghsa":[{"id":"GHSA-5v4m-c73v-c7gq","title":"Arbitrary Code Execution in Cookie Serialization","description":"The default serialization used by Plug session may result in code execution\n  in certain situations. Keep in mind, however, the session cookie is signed\n  and this attack can only be exploited if the attacker has access to your\n  secret key as well as your signing/encryption salts. We recommend users to\n  change their secret key base and salts if they suspect they have been leaked,\n  regardless of this vulnerability.","status":"published","published":"2022-04-12T21:23:43Z","modified":"2023-01-11T05:06:34Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:36:13.23016Z"}],"nvd":[{"id":"CVE-2017-1000053","description":"Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session.","status":"published","published":"2017-07-17T13:18:17.627Z","modified":"2026-06-17T00:58:39.357Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:03:54.012105Z"}],"osv":[{"id":"CVE-2017-1000053","description":"Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session.","status":"published","published":"2017-07-17T13:18:17.627Z","modified":"2026-10-24T10:30:38.257185788Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.472693Z"},{"id":"GHSA-5v4m-c73v-c7gq","title":"Arbitrary Code Execution in Cookie Serialization","description":"The default serialization used by Plug session may result in code execution\n  in certain situations. Keep in mind, however, the session cookie is signed\n  and this attack can only be exploited if the attacker has access to your\n  secret key as well as your signing/encryption salts. We recommend users to\n  change their secret key base and salts if they suspect they have been leaked,\n  regardless of this vulnerability.","status":"published","published":"2022-04-12T21:23:43Z","modified":"2025-12-10T00:29:29.165962Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:38.911014Z"}]}}