CVE-2025-15618

CRITICAL9.1

Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key

Published Mar 31, 2026

Modified 3 weeks ago

Details

Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key.

Business::OnlinePayment::StoredTransaction generates a secret key by using a MD5 hash of a single call to the built-in rand function, which is unsuitable for cryptographic use.

This key is intended for encrypting credit card transaction data.

References

WEB

http://www.openwall.com/lists/oss-security/2026/03/31/7

WEB

https://metacpan.org/dist/Business-OnlinePayment-StoredTransaction/source/lib/Business/OnlinePayment/StoredTransaction.pm#L64-75

WEB

https://security.metacpan.org/patches/B/Business-OnlinePayment-StoredTransaction/0.01/CVE-2025-15618-r1.patch

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2025-15618

CVSS Analysis

CVSS v3.1

9.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

NoneA:N

9.1/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness Type (CWE)

Other

CWE-338

CWE-693

Ecosystems

Timeline

PublishedMar 31, 2026

ModifiedMar 31, 2026