CVE-2025-40915
Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens
Summary
Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens
Original description
The description as published by the source.
Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens.
That version of the module generates tokens as an MD5 of the process id, the current time, and a single call to the built-in rand() function.
References
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- web cpan.org
- web metacpan.org
- web metacpan.org