CVE-2025-40933 — Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely

CVE-2025-40933

Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely PUBLISHED

Description (CNA)

Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely. Session ids are generated using an MD5 hash of the epoch time and a call to the built-in rand function. The epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.

Affected (CNA)

Vendor / product	Versions
KGOLDOV / Apache::AuthAny	affected 0.19 through 0.201

CWE

CWE-340, CWE-338

References

https://metacpan.org/release/KGOLDOV/Apache2-AuthAny-0.201/source/lib/Apache2/AuthAny/Cookie.pm

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.