CGI::Session::ID::md5 versions prior to 4.49 generate session identifiers by hashing the process id, the current epoch time, and Perl’s built‑in rand() function. All three components are predictable, low‑entropy sources. This weakness corresponds to CWE‑331 (Insufficient Entropy), CWE‑338 (Insufficient Randomness) and CWE‑340 (Predictable). An attacker who predicts a session id can impersonate the corresponding session and bypass authentication, compromising confidentiality and integrity of data protected by the session.

The vulnerability impacts the MARKSTOS CGI::Session::ID::md5 module for Perl. Versions prior to 4.49 are affected. No specific operating system or server platform is listed, so any system running the affected module in a web context is at risk.

With a CVSS score of 5.9, the vulnerability presents a moderate level of risk. The EPSS score of < 1% indicates a low but nonzero probability of exploitation, yet the weakness still enables an attacker who can observe the HTTP Date header or otherwise estimate the server’s current time identifiers. The likely attack vector is remote access over HTTP/HTTPS, where an attacker can manipulate request timing or monitor session ID values. Because the epoch time, process ID, and Perl’s rand() function all have low entropy, hijacking the session and impersonating a legitimate user becomes feasible. The vulnerability is not listed in the CISA KEV catalog.