Description (CNA)
Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens. That version of the module generates tokens as an MD5 of the process id, the current time, and a single call to the built-in rand() function.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| GRYPHON / Mojolicious::Plugin::CSRF | affected 1.03 |
CWE
CWE-338
References
- https://metacpan.org/release/GRYPHON/Mojolicious-Plugin-CSRF-1.04/diff/GRYPHON/Mojolicious-Plugin-CSRF-1.03
- https://metacpan.org/release/GRYPHON/Mojolicious-Plugin-CSRF-1.04/changes
ADP enrichment
No English description supplied.
No references supplied.