Skip to content
OpenAdvisories
High · 7.0 CVE-2025-40915 EUVD-2025-18132GHSA-mqr9-mgqq-52rq

Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens

Published Jun 11, 2025 · Updated Jun 11, 2025 · Assigned by CPANSec

Description

Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens.

That version of the module generates tokens as an MD5 of the process id, the current time, and a single call to the built-in rand() function.

Affected products

VendorProductAffectedFixed
GRYPHON Mojolicious::Plugin::CSRF 1.03 —

References