CVE-2024-58134highCWE-321CWE-331

CVE-2024-58134: high-severity vulnerability in SRI Mojolicious

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default

Published · Updated

Follow this CVE+ Monitor Mojolicious+ Monitor libmojolicious-perl

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 0.6%
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies.  An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
SRI · Mojolicious
Related CVEs — SRI Mojolicious

In the same product, most dangerous first.

CVE-2024-58135MEDIUMMojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by defaultEPSS 0.6%CVE-2026-15747CRITICALMojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracleEPSS 0.3%