CVE-2025-40933

HIGH7.5

Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely

Published Sep 17, 2025

Modified 5 months ago

Details

Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely.

Session ids are generated using an MD5 hash of the epoch time and a call to the built-in rand function. The epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.

Predicable session ids could allow an attacker to gain access to systems.

References

WEB

https://metacpan.org/release/KGOLDOV/Apache2-AuthAny-0.201/source/lib/Apache2/AuthAny/Cookie.pm

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2025-40933

CVSS Analysis

CVSS v3.1

7.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness Type (CWE)

Other

CWE-338

CWE-340

Ecosystems

Timeline

PublishedSep 17, 2025

ModifiedSep 17, 2025

CVE-2025-40933 | Mondoo Vulnerability Intelligence