PT-2025-15065 · Unknown · Webservice::Xero+1

Robert Rothenberg

·

Published

2025-04-05

·

Updated

2025-11-13

·

CVE-2024-52322

CVSS v3.1

5.5

Medium

VectorAV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions WebService::Xero versions 0.11 and earlier
Description The issue concerns the use of a non-cryptographically secure source of entropy for cryptographic functions. Specifically, WebService::Xero uses the Data::Random library, which relies on the rand() function. This library is intended for use in test programs, indicating its inadequacy for secure cryptographic operations.
Recommendations For WebService::Xero versions 0.11 and earlier, consider updating to a version that utilizes a cryptographically secure source of entropy for its cryptographic functions. As a temporary workaround, consider disabling the use of the Data::Random library until a secure alternative is implemented. Restrict access to cryptographic functions that rely on the rand() function to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-331CWE-338

Related Identifiers

CVE-2024-52322

Affected Products

Data::Random
Webservice::Xero