Session ids are generated using an MD5 hash of the epoch time and a call to the built-in rand function. The epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.
Predicable session ids could allow an attacker to gain access to systems.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| KGOLDOV | Apache::AuthAny | unaffected |
|
No data.
No data.
No data available yet.
No remediation available yet.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2025-29729 | Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely. Session ids are generated using an MD5 hash of the epoch time and a call to the built-in rand function. The epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. |
Wed, 17 Sep 2025 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Wed, 17 Sep 2025 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely. Session ids are generated using an MD5 hash of the epoch time and a call to the built-in rand function. The epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. | |
| Title | Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely | |
| Weaknesses | CWE-338 CWE-340 |
|
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2025-09-17T17:21:55.927Z
Reserved: 2025-04-16T09:05:34.363Z
Link: CVE-2025-40933
Vulnrichment
Updated: 2025-09-17T17:20:31.409Z
NVD
Status : Deferred
Published: 2025-09-17T15:15:42.927
Modified: 2026-04-15T00:35:42.020
Link: CVE-2025-40933
Redhat
No data.
OpenCVE Enrichment
No data.