Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2025-40915

Summary
Assigner-CPANSec
Assigner Org ID-9b29abf9-4ab0-4765-b253-1875cd9b441e
Published At-11 Jun, 2025 | 17:09
Updated At-11 Jun, 2025 | 17:57
Rejected At-
Credits

Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens

Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens. That version of the module generates tokens as an MD5 of the process id, the current time, and a single call to the built-in rand() function.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:CPANSec
Assigner Org ID:9b29abf9-4ab0-4765-b253-1875cd9b441e
Published At:11 Jun, 2025 | 17:09
Updated At:11 Jun, 2025 | 17:57
Rejected At:
▼CVE Numbering Authority (CNA)
Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens

Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens. That version of the module generates tokens as an MD5 of the process id, the current time, and a single call to the built-in rand() function.

Affected Products
Vendor
GRYPHON
Product
Mojolicious::Plugin::CSRF
Collection URL
https://cpan.org/modules
Package Name
Mojolicious-Plugin-CSRF
Repo
https://github.com/gryphonshafer/Mojo-Plugin-CSRF
Default Status
unaffected
Versions
Affected
  • 1.03 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-338CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
Type: CWE
CWE ID: CWE-338
Description: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-62CAPEC-62: Cross Site Request Forgery
CAPEC ID: CAPEC-62
Description: CAPEC-62: Cross Site Request Forgery
Solutions

Users of version 1.03 should upgrade to 1.04.

Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://metacpan.org/release/GRYPHON/Mojolicious-Plugin-CSRF-1.04/diff/GRYPHON/Mojolicious-Plugin-CSRF-1.03
N/A
https://metacpan.org/release/GRYPHON/Mojolicious-Plugin-CSRF-1.04/changes
N/A
Hyperlink: https://metacpan.org/release/GRYPHON/Mojolicious-Plugin-CSRF-1.04/diff/GRYPHON/Mojolicious-Plugin-CSRF-1.03
Resource: N/A
Hyperlink: https://metacpan.org/release/GRYPHON/Mojolicious-Plugin-CSRF-1.04/changes
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
3.17.0HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Version: 3.1
Base score: 7.0
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:9b29abf9-4ab0-4765-b253-1875cd9b441e
Published At:11 Jun, 2025 | 17:15
Updated At:12 Jun, 2025 | 16:06

Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens. That version of the module generates tokens as an MD5 of the process id, the current time, and a single call to the built-in rand() function.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.17.0HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Type: Secondary
Version: 3.1
Base score: 7.0
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
CPE Matches
Weaknesses
CWE IDTypeSource
CWE-338Secondary9b29abf9-4ab0-4765-b253-1875cd9b441e
CWE ID: CWE-338
Type: Secondary
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://metacpan.org/release/GRYPHON/Mojolicious-Plugin-CSRF-1.04/changes9b29abf9-4ab0-4765-b253-1875cd9b441e
N/A
https://metacpan.org/release/GRYPHON/Mojolicious-Plugin-CSRF-1.04/diff/GRYPHON/Mojolicious-Plugin-CSRF-1.039b29abf9-4ab0-4765-b253-1875cd9b441e
N/A
Hyperlink: https://metacpan.org/release/GRYPHON/Mojolicious-Plugin-CSRF-1.04/changes
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Resource: N/A
Hyperlink: https://metacpan.org/release/GRYPHON/Mojolicious-Plugin-CSRF-1.04/diff/GRYPHON/Mojolicious-Plugin-CSRF-1.03
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

1Records found
CVE-2025-40916
Matching Score-6
Assigner-CPAN Security Group
ShareView Details
Matching Score-6
Assigner-CPAN Security Group
CVSS Score-9.1||CRITICAL
EPSS-0.04% / 12.57%
||
7 Day CHG~0.00%
Published-16 Jun, 2025 | 11:01
Updated-16 Jun, 2025 | 14:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha text

Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha. That version uses the built-in rand() function for generating the captcha text as well as image noise, which is insecure.

Action-Not Available
Vendor-GRYPHON
Product-Mojolicious::Plugin::CaptchaPNG
CWE ID-CWE-338
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CWE ID-CWE-804
Guessable CAPTCHA
Details not found