CVE-2025-40923

{"id": "CVE-2025-40923", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "published": "2025-07-16T13:15:23.997", "references": [{"url": "https://github.com/plack/Plack-Middleware-Session/commit/1fbfbb355e34e7f4b3906f66cf958cedadd2b9be.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://github.com/plack/Plack-Middleware-Session/pull/52", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.34/source/lib/Plack/Session/State.pm#L22", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://security.metacpan.org/docs/guides/random-data-for-security.html", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2025/07/16/4", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-338"}, {"lang": "en", "value": "CWE-340"}]}], "descriptions": [{"lang": "en", "value": "Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely.\n\nThe default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nPredicable session ids could allow an attacker to gain access to systems."}, {"lang": "es", "value": "Las versiones anteriores a la 0.35 de Plack-Middleware-Session para Perl generan identificadores de sesi\u00f3n de forma insegura. El generador de identificadores de sesi\u00f3n predeterminado devuelve un hash SHA-1 con la funci\u00f3n rand integrada, la fecha y hora y el PID. El PID se obtendr\u00e1 de un peque\u00f1o conjunto de n\u00fameros, y la fecha y hora pueden ser adivinadas si no se filtran del encabezado HTTP Date. La funci\u00f3n rand integrada no es adecuada para uso criptogr\u00e1fico. Los identificadores de sesi\u00f3n predecibles podr\u00edan permitir que un atacante acceda a los sistemas. "}], "lastModified": "2025-11-04T22:16:12.360", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}