CVE-2025-40916: falha crítica em GRYPHON Mojolicious::Plugin::CaptchaPNG
Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha text
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.4%
Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha.
That version uses the built-in rand() function for generating the captcha text as well as image noise, which is insecure.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
GRYPHON · Mojolicious::Plugin::CaptchaPNGReferências
https://metacpan.org/pod/perlfunc#randhttps://metacpan.org/release/GRYPHON/Mojolicious-Plugin-CaptchaPNG-1.04/diff/GRYPHON/Mojolicious-Plugin-CaptchaPNG-1.05/lib/Mojolicious/Plugin/CaptchaPNG.pmhttps://metacpan.org/release/GRYPHON/Mojolicious-Plugin-CaptchaPNG-1.06/changeshttps://security.metacpan.org/docs/guides/random-data-for-security.html