EUVD-2026-40927
GHSA-r49c-4q8x-x33v
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-based session prediction requires high complexity; no privileges needed; impact is confidentiality only via session exposure, with no integrity or availability consequence at the module level.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
3DescriptionCVE.org
CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources.
The generate_id method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand() function. All three are predictable, low-entropy sources: the PID is drawn from a small range, the epoch time can be guessed or read from the HTTP Date header, and Perl's rand() is unsuitable for security purposes because it is predictable and reversible.
An attacker who predicts a session id can impersonate the corresponding session and bypass authentication.
AnalysisAI
Session identifier generation in CGI::Session::ID::md5 versions prior to 4.49 for Perl is cryptographically weak, enabling remote attackers with sufficient effort to predict valid session tokens and impersonate authenticated users. The generate_id method combines three deterministic or low-entropy sources - process ID, Unix epoch timestamp, and Perl's non-cryptographic rand() - before hashing with MD5, leaving the session ID space practically enumerable given approximate knowledge of server state. No public exploit has been identified at time of analysis; SSVC assigns Exploitation: none and EPSS places this at the 8th percentile, indicating low real-world exploitation probability despite the C:H confidentiality impact.
Technical ContextAI
CGI::Session is a Perl CPAN distribution (maintained by MARKSTOS, CPE cpe:2.3:a:markstos:cgi::session::id::md5) providing session management for CGI-based web applications. The affected component, CGI::Session::ID::md5, implements the session ID generation driver using MD5 (Message Digest 5). CWE-340 (Generation of Predictable Numbers or Identifiers) is the root cause: generate_id seeds MD5 with the OS process ID (a small integer drawn from a constrained kernel range), the Unix epoch timestamp (partially observable via the HTTP Date response header), and Perl's built-in rand(), which is a linear congruential generator that is neither cryptographically secure nor suitable for producing unpredictable identifiers. MD5 provides no entropy amplification - it merely obfuscates deterministic inputs - so the effective session ID space is far smaller than the 128-bit hash output implies. The fix in version 4.49 replaces this scheme with a cryptographically appropriate entropy source.
RemediationAI
Upgrade to CGI-Session 4.49 or later, which replaces the predictable generate_id implementation in the md5 driver with a cryptographically appropriate source. The patched source is available at https://metacpan.org/release/MARKSTOS/CGI-Session-4.49/source/lib/CGI/Session/ID/md5.pm and the changelog at https://metacpan.org/release/MARKSTOS/CGI-Session-4.49/changes. If immediate upgrade is not feasible, consider switching to an alternative CGI::Session ID driver that draws entropy from /dev/urandom or the OS CSPRNG rather than PID and rand(). As a compensating control, enforcing aggressive session lifetimes (short idle and absolute timeouts) reduces the window during which a predicted session ID remains valid, at the cost of increased re-authentication friction for end users. Suppressing or randomizing the HTTP Date response header removes one observable input that helps narrow the attacker's timestamp search space, though this is a minor hardening measure rather than a fix.
irc.cgi in CGI:IRC before 0.5.12 reflects user-supplied input from the R parameter without proper output encoding, aka X
In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Ser
Stack-based buffer overflow in Logica HotScan allows remote attackers to cause a denial of service (crash) via a crafted
In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#es
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today