CVE-2025-40915: Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens
Published Jun 11, 2025
·Updated
Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens.
That version of the module generates tokens as an MD5 of the process id, the current time, and a single call to the built-in rand() function.
Affected Software
1 affected component
Mojolicious Plugin::CSRF
Remediation
Information
Users of version 1.03 should upgrade to 1.04.
Event History
Jun 11, 2025
CVE Published
via MITRE·05:09 PM
Data Sourced
via MITRE·05:09 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-40915?
CVE-2025-40915 has a moderate severity due to its use of a weak random number generator for CSRF token creation.
2
How do I fix CVE-2025-40915?
To fix CVE-2025-40915, upgrade to Mojolicious::Plugin::CSRF version 1.04 or later.
3
What vulnerabilities does CVE-2025-40915 expose?
CVE-2025-40915 exposes applications to potential Cross-Site Request Forgery (CSRF) attacks due to weak token generation.
4
Which versions of Mojolicious::Plugin::CSRF are affected by CVE-2025-40915?
CVE-2025-40915 affects Mojolicious::Plugin::CSRF version 1.03 and earlier.
5
Is there a workaround for CVE-2025-40915 if I cannot upgrade now?
There are no reliable workarounds for CVE-2025-40915, so upgrading is the recommended action.