CVE-2025-40923
Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely
- State
- Published
- Severity
- 7.3 High
- Published
- Jul 16, 2025
- Updated
- Nov 4, 2025
- Reserved
- Apr 16, 2025
Description
Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely.
The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.
Predicable session ids could allow an attacker to gain access to systems.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | CISA-ADP |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Plack::Middleware::SessionMIYAGAWA |
|
References
- https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.34/source/lib/Plack/Session/State.pm#L22
- https://github.com/plack/Plack-Middleware-Session/pull/52
- https://github.com/plack/Plack-Middleware-Session/commit/1fbfbb355e34e7f4b3906f66cf958cedadd2b9be.patchpatch
- https://security.metacpan.org/docs/guides/random-data-for-security.html
- http://www.openwall.com/lists/oss-security/2025/07/16/4
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.