CVE-2025-40923

Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/plack/Plack-Middleware-Session/commit/1fbfbb355e34e7f4b3906f66cf958cedadd2b9be.patch
https://github.com/plack/Plack-Middleware-Session/pull/52
https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.34/source/lib/Plack/Session/State.pm#L22
https://security.metacpan.org/docs/guides/random-data-for-security.html
http://www.openwall.com/lists/oss-security/2025/07/16/4

Configurations

No configuration.

History

04 Nov 2025, 22:16

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2025/07/16/4 -

Information

Published : 2025-07-16 13:15

Updated : 2025-11-04 22:16

NVD link : CVE-2025-40923

Mitre link : CVE-2025-40923

CVE.ORG link : CVE-2025-40923

JSON object : View

Products Affected

No product.

CWE

CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CWE-340

Generation of Predictable Numbers or Identifiers

{"id": "CVE-2025-40923", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "published": "2025-07-16T13:15:23.997", "references": [{"url": "https://github.com/plack/Plack-Middleware-Session/commit/1fbfbb355e34e7f4b3906f66cf958cedadd2b9be.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://github.com/plack/Plack-Middleware-Session/pull/52", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.34/source/lib/Plack/Session/State.pm#L22", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://security.metacpan.org/docs/guides/random-data-for-security.html", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2025/07/16/4", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-338"}, {"lang": "en", "value": "CWE-340"}]}], "descriptions": [{"lang": "en", "value": "Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely.\n\nThe default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nPredicable session ids could allow an attacker to gain access to systems."}, {"lang": "es", "value": "Las versiones anteriores a la 0.35 de Plack-Middleware-Session para Perl generan identificadores de sesi\u00f3n de forma insegura. El generador de identificadores de sesi\u00f3n predeterminado devuelve un hash SHA-1 con la funci\u00f3n rand integrada, la fecha y hora y el PID. El PID se obtendr\u00e1 de un peque\u00f1o conjunto de n\u00fameros, y la fecha y hora pueden ser adivinadas si no se filtran del encabezado HTTP Date. La funci\u00f3n rand integrada no es adecuada para uso criptogr\u00e1fico. Los identificadores de sesi\u00f3n predecibles podr\u00edan permitir que un atacante acceda a los sistemas. "}], "lastModified": "2025-11-04T22:16:12.360", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}