PT-2026-22228 · Unknown · Apache::Session

Robert Rothenberg · Publicado 2026-02-26 · Atualizado 2026-03-04 · CVE-2025-40932

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache::SessionX versions through 2.01

Description Apache::SessionX generates session IDs insecurely. The default session ID generator returns an MD5 hash seeded with the built-in rand() function, the epoch time, and the process ID (PID). The PID comes from a limited set of numbers, and the epoch time may be predictable if not leaked from the HTTP Date header. The rand() function is not suitable for cryptographic purposes. Predictable session IDs could allow an attacker to gain unauthorized access to systems.

Recommendations Update Apache::SessionX to a version later than 2.01.

Correção

Enumeração de Fraquezas

CWE-340

CWE-338

Identificadores relacionados

CVE-2025-40932

Produtos afetados

Apache::Session

Referências · 14

• https://metacpan.org/release/GRICHTER/Apache-SessionX-2.01/source/SessionX/Generate/MD5.pm#L29 · Nota
• https://lists.security.metacpan.org/cve-announce/msg/37425045 · Nota
• https://twitter.com/TheHackerWire/status/2027462995241226264 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2025-40932 · Aviso do Fabricante
• https://t.me/cveNotify/154022 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-40932 · Nota de Segurança
• https://twitter.com/cracbot/status/2029149915738439726 · Publicação no Twitter
• https://twitter.com/cracbot/status/2028787709058461860 · Publicação no Twitter
• https://cve.org/CVERecord?id=CVE-2025-40932 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-40932 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-40932 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2025-40932 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2027466619388367163 · Publicação no Twitter
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-40932 · Aviso do Fabricante