« Volver al listado

CVE-2025-40932

Estado: AnalizadaAlta (8.2)—

Apache::SessionX versions through 2.01 for Perl create insecure session id.

Apache::SessionX generates session ids insecurely. The default session id generator in Apache::SessionX::Generate::MD5 returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/PR:N/UI:N indica acceso remoto sin autenticación; generación predecible de SID (MD5 débil, rand() inseguro) permite forjar sesiones válidas y acceder a cuentas de usuario. CWE-338, CWE-340 confirman debilidad criptográfica.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkVulnerability ScanningUser Account ManagementPassword Policies

Tecnologías afectadas (1)

Grichter — Apache\

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-40932",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-40932",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-27T18:39:16.068005Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "GRICHTER",
          "product": "Apache::SessionX",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2.01"
            }
          ],
          "packageName": "Apache-SessionX",
          "programFiles": [
            "lib/SessionX/Generate/MD5.pm"
          ],
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-02-27T00:16:55.107",
  "references": [
    {
      "url": "https://metacpan.org/release/GRICHTER/Apache-SessionX-2.01/source/SessionX/Generate/MD5.pm#L29",
      "tags": [
        "Issue Tracking"
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "description": [
        {
          "lang": "en",
          "value": "CWE-338"
        },
        {
          "lang": "en",
          "value": "CWE-340"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache::SessionX versions through 2.01 for Perl create insecure session id.\n\nApache::SessionX generates session ids insecurely. The default session id generator in Apache::SessionX::Generate::MD5 returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems."
    },
    {
      "lang": "es",
      "value": "Las versiones de Apache::SessionX hasta la 2.01 para Perl crean un ID de sesión inseguro.\n\nApache::SessionX genera IDs de sesión de forma insegura. El generador de ID de sesión predeterminado en Apache::SessionX::Generate::MD5 devuelve un hash MD5 sembrado con la función rand() incorporada, el tiempo de época y el PID. El PID provendrá de un pequeño conjunto de números, y el tiempo de época puede ser adivinado, si no se filtra del encabezado HTTP Date. La función rand incorporada no es adecuada para uso criptográfico. Los IDs de sesión predecibles podrían permitir a un atacante obtener acceso a los sistemas."
    }
  ],
  "lastModified": "2026-06-17T09:22:19.230",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:grichter:apache\\:\\:sessionx:*:*:*:*:*:perl:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22753273-E170-4375-A53C-E0C5CEF00FAD",
              "versionEndIncluding": "2.01"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
}