PT-2026-22228 · Unknown · Apache::Session

Robert Rothenberg · Published 2026-02-26 · Updated 2026-03-04 · CVE-2025-40932

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache::SessionX versions through 2.01

Description Apache::SessionX generates session IDs insecurely. The default session ID generator returns an MD5 hash seeded with the built-in rand() function, the epoch time, and the process ID (PID). The PID comes from a limited set of numbers, and the epoch time may be predictable if not leaked from the HTTP Date header. The rand() function is not suitable for cryptographic purposes. Predictable session IDs could allow an attacker to gain unauthorized access to systems.

Recommendations Update Apache::SessionX to a version later than 2.01.

Fix

Weakness Enumeration

CWE-340

CWE-338

Related Identifiers

CVE-2025-40932

Affected Products

Apache::Session

References · 14

• https://ubuntu.com/security/CVE-2025-40932 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40932 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-40932 · Security Note
• https://osv.dev/vulnerability/CVE-2025-40932 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-40932 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-40932 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-40932 · Vendor Advisory
• https://metacpan.org/release/GRICHTER/Apache-SessionX-2.01/source/SessionX/Generate/MD5.pm#L29 · Note
• https://lists.security.metacpan.org/cve-announce/msg/37425045 · Note
• https://twitter.com/TheHackerWire/status/2027462995241226264 · Twitter Post
• https://t.me/cveNotify/154022 · Telegram Post
• https://twitter.com/cracbot/status/2029149915738439726 · Twitter Post
• https://twitter.com/cracbot/status/2028787709058461860 · Twitter Post
• https://twitter.com/CVEnew/status/2027466619388367163 · Twitter Post