PT-2026-22392 · Unknown · Http::Session2
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
HTTP::Session2 versions prior to 1.12
Description
The software may generate weak session IDs using the
rand() function. The session ID generator returns a SHA-1 hash seeded with the rand() function, epoch time, and the process ID (PID). The rand() function is not suitable for cryptographic purposes. If the /dev/urandom device is unavailable, the software reverts to this insecure method.Recommendations
Update to version 1.12 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Http::Session2