CVE-2025-40923

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40923", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2025-04-16T09:05:34.362Z", "datePublished": "2025-07-16T13:05:03.782Z", "dateUpdated": "2025-11-04T21:10:20.704Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Plack-Middleware-Session", "product": "Plack::Middleware::Session", "programFiles": ["lib/Plack/Session/State.pm"], "repo": "https://github.com/plack/Plack-Middleware-Session", "vendor": "MIYAGAWA", "versions": [{"lessThan": "0.35", "status": "affected", "version": "0.01", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely.</div><div>The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.</div><div>Predicable session ids could allow an attacker to gain access to systems.</div>"}], "value": "Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely.\n\nThe default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nPredicable session ids could allow an attacker to gain access to systems."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-340", "description": "CWE-340 Generation of Predictable Numbers or Identifiers", "lang": "en", "type": "CWE"}, {"cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2025-07-16T13:05:03.782Z"}, "references": [{"url": "https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.34/source/lib/Plack/Session/State.pm#L22"}, {"url": "https://github.com/plack/Plack-Middleware-Session/pull/52"}, {"tags": ["patch"], "url": "https://github.com/plack/Plack-Middleware-Session/commit/1fbfbb355e34e7f4b3906f66cf958cedadd2b9be.patch"}, {"url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>Users are advised to upgrade to Plack-Middleware-Session v0.35 or later.</div>"}], "value": "Users are advised to upgrade to Plack-Middleware-Session v0.35 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>Users who are unable to upgrade are advised to change the sid_generator attribute of Plack::Session::State to a function that returns a securely generated session id based on a secure source of entropy from the system.</div>"}], "value": "Users who are unable to upgrade are advised to change the sid_generator attribute of Plack::Session::State to a function that returns a securely generated session id based on a secure source of entropy from the system."}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-07-16T20:47:49.157521Z", "id": "CVE-2025-40923", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-16T20:48:17.516Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/07/16/4"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T21:10:20.704Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/07/16/4"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T21:10:20.704Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-40923", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-16T20:47:49.157521Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-16T20:48:04.599Z"}}], "cna": {"title": "Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/plack/Plack-Middleware-Session", "vendor": "MIYAGAWA", "product": "Plack::Middleware::Session", "versions": [{"status": "affected", "version": "0.01", "lessThan": "0.35", "versionType": "custom"}], "packageName": "Plack-Middleware-Session", "programFiles": ["lib/Plack/Session/State.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Users are advised to upgrade to Plack-Middleware-Session v0.35 or later.", "supportingMedia": [{"type": "text/html", "value": "<div>Users are advised to upgrade to Plack-Middleware-Session v0.35 or later.</div>", "base64": false}]}], "references": [{"url": "https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.34/source/lib/Plack/Session/State.pm#L22"}, {"url": "https://github.com/plack/Plack-Middleware-Session/pull/52"}, {"url": "https://github.com/plack/Plack-Middleware-Session/commit/1fbfbb355e34e7f4b3906f66cf958cedadd2b9be.patch", "tags": ["patch"]}, {"url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"}], "workarounds": [{"lang": "en", "value": "Users who are unable to upgrade are advised to change the sid_generator attribute of Plack::Session::State to a function that returns a securely generated session id based on a secure source of entropy from the system.", "supportingMedia": [{"type": "text/html", "value": "<div>Users who are unable to upgrade are advised to change the sid_generator attribute of Plack::Session::State to a function that returns a securely generated session id based on a secure source of entropy from the system.</div>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely.\n\nThe default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nPredicable session ids could allow an attacker to gain access to systems.", "supportingMedia": [{"type": "text/html", "value": "<div>Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely.</div><div>The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.</div><div>Predicable session ids could allow an attacker to gain access to systems.</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-340", "description": "CWE-340 Generation of Predictable Numbers or Identifiers"}, {"lang": "en", "type": "CWE", "cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2025-07-16T13:05:03.782Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40923", "state": "PUBLISHED", "dateUpdated": "2025-11-04T21:10:20.704Z", "dateReserved": "2025-04-16T09:05:34.362Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2025-07-16T13:05:03.782Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Plack-Middleware-Session", "product": "Plack::Middleware::Session", "programFiles": ["lib/Plack/Session/State.pm"], "repo": "https://github.com/plack/Plack-Middleware-Session", "vendor": "MIYAGAWA", "versions": [{"lessThan": "0.35", "status": "affected", "version": "0.01", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely.\n\nThe default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nPredicable session ids could allow an attacker to gain access to systems."}, {"lang": "es", "value": "Las versiones anteriores a la 0.35 de Plack-Middleware-Session para Perl generan identificadores de sesi\u00f3n de forma insegura. El generador de identificadores de sesi\u00f3n predeterminado devuelve un hash SHA-1 con la funci\u00f3n rand integrada, la fecha y hora y el PID. El PID se obtendr\u00e1 de un peque\u00f1o conjunto de n\u00fameros, y la fecha y hora pueden ser adivinadas si no se filtran del encabezado HTTP Date. La funci\u00f3n rand integrada no es adecuada para uso criptogr\u00e1fico. Los identificadores de sesi\u00f3n predecibles podr\u00edan permitir que un atacante acceda a los sistemas. "}], "id": "CVE-2025-40923", "lastModified": "2026-06-17T09:22:17.947", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40923", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-16T20:47:49.157521Z", "version": "2.0.3"}}]}, "published": "2025-07-16T13:15:23.997", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/plack/Plack-Middleware-Session/commit/1fbfbb355e34e7f4b3906f66cf958cedadd2b9be.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/plack/Plack-Middleware-Session/pull/52"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.34/source/lib/Plack/Session/State.pm#L22"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2025/07/16/4"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-338"}, {"lang": "en", "value": "CWE-340"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{}