How to fix CVE-2024-58134?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Vendor patch is available.

Is Mojolicious affected by CVE-2024-58134?

CVE-2024-58134 presents notable security risk, a hard-coded crypto key vulnerability rated CVSS 8.1. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise.

CVE-2024-58134

HIGH

2025-05-03 9b29abf9-4ab0-4765-b253-1875cd9b441e

Information Disclosure Mojolicious Suse

8.1

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:39 vuln.today

Patch Released

Mar 28, 2026 - 18:39 nvd

Patch available

PoC Detected

Oct 20, 2025 - 20:15 vuln.today

Public exploit code

CVE Published

May 03, 2025 - 16:15 nvd

HIGH 8.1

DescriptionNVD

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default.

These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.

AnalysisAI

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-321. Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session. Affected products include: Mojolicious.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Vendor StatusVendor

CVE-2024-58134 vulnerability details – vuln.today

Back