CVE-2025-40933
BaseFortify
Publication date: 2025-09-17
Last updated on: 2025-09-18
Assigner: CPANSec
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | apache2_authany | 0.201 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-338 | The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. |
| CWE-340 | The product uses a scheme that generates numbers or identifiers that are more predictable than required. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Apache::AuthAny::Cookie v0.201 or earlier for Perl, where session IDs are generated insecurely. The session IDs are created using an MD5 hash of the epoch time combined with a call to the built-in rand function. Since the epoch time can be guessed and the built-in rand function is not suitable for cryptographic purposes, the resulting session IDs are predictable.
How can this vulnerability impact me? :
Because the session IDs are predictable, an attacker could potentially guess or reproduce valid session IDs, allowing them to gain unauthorized access to systems that rely on these session IDs for authentication.