CVE-2025-40932
Apache::SessionX versions through 2.01 for Perl create insecure session id
CVSS Score
8.2
EPSS Score
0.0%
EPSS Percentile
0th
Apache::SessionX versions through 2.01 for Perl create insecure session id. Apache::SessionX generates session ids insecurely. The default session id generator in Apache::SessionX::Generate::MD5 returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.
| CWE | CWE-340 CWE-338 |
| Vendor | grichter |
| Product | apache::sessionx |
| Published | Feb 26, 2026 |
| Last Updated | Feb 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for grichter apache::sessionx
Be the first to know when new high vulnerabilities affecting grichter apache::sessionx are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
GRICHTER / Apache::SessionX
0 ≤ 2.01
References
Credits
Robert Rothenberg