CVE-2025-40924: haarg catalyst::plugin::session

Vulnerability summary

CVE-2025-40924 is a medium (CVSS 6.5) vulnerability in haarg catalyst::plugin::session. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.4% of scored vulnerabilities.

Timeline

1. 17-07-2025
   PublishedVulnerability first disclosed.
2. 17-07-2025
   Last modifiedVulnerability information updated.

Description

Catalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurely. The session id is generated from a (usually SHA-1) hash of a simple counter, the epoch time, the built-in rand function, the PID and the current Catalyst context. This information is of low entropy. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.

• CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
• CWE-340Generation of Predictable Numbers or IdentifiersThe product uses a scheme that generates numbers or identifiers that are more predictable than required.