Mark Stosberg

**Name of the Vulnerable Software and Affected Versions** CGI::Session::ID::md5 versions prior to 4.49 **Description** Predictable session IDs are generated from low-entropy sources. The `generate id()` function creates the session ID using an MD5 digest of the process ID, the epoch time, and the built-in `rand()` function. These sources are considered low-entropy because the process ID is drawn from a small range, the epoch time can be guessed or retrieved from the HTTP Date header, and the `rand()` function is predictable and reversible. An attacker who predicts a session ID can impersonate a session and bypass authentication. **Recommendations** Update CGI::Session::ID::md5 to version 4.49 or later.