CVE-2025-40915

HIGH EPSS 15.3%
Published Jun 11, 20251y ago · Modified Jun 17, 20262w ago
7.0 CVSS 3.1
High
Find Similar
Published Jun 11, 2025 1y ago
Last Modified Jun 17, 2026 2w ago

Description

Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens. That version of the module generates tokens as an MD5 of the process id, the current time, and a single call to the built-in rand() function.

CVSS Details

Base Score
7.0
Exploitability
2.2
Impact
4.7
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity Low
Availability Low

Threat Intelligence

EPSS Exploit Probability
15.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-338

References 2

  • metacpan.org https://metacpan.org/release/GRYPHON/Mojolicious-Plugin-CSRF-1.04/changes
  • metacpan.org https://metacpan.org/release/GRYPHON/Mojolicious-Plugin-CSRF-1.04/diff/GRYPHON/Mojolicious-Plugin-CSRF-1.03

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.