Apache Cocoon vulnerable to Incorrect Usage of Seeds in Pseudo-Random Number Generator

🗓️ 27 Jan 2025 15:30:58Reported by GitHub Advisory DatabaseType

Apache Cocoon has a vulnerability in PRNG that can expose continuation identifiers to attackers.

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2025-24783	27 Jan 202514:49	–	circl
CNNVD	Apache Cocoon 安全漏洞	27 Jan 202500:00	–	cnnvd
CVE	CVE-2025-24783	27 Jan 202514:47	–	cve
Cvelist	CVE-2025-24783 Apache Cocoon: continuations may not be private	27 Jan 202514:47	–	cvelist
EUVD	EUVD-2025-0182	3 Oct 202520:07	–	euvd
NVD	CVE-2025-24783	27 Jan 202515:15	–	nvd
OSV	GHSA-PFF9-53M5-QR56 Apache Cocoon vulnerable to Incorrect Usage of Seeds in Pseudo-Random Number Generator	27 Jan 202515:30	–	osv
Positive Technologies	PT-2025-5567 · Apache · Apache Cocoon	27 Jan 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-24783	23 May 202512:00	–	redhatcve
Veracode	Incorrect Usage Of Seeds	30 Jan 202504:02	–	veracode

Vulners

Node

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-24783
lists	www.lists.apache.org/thread/pk86jp5cvn41432op8wv1k8p14mp27nz
github	www.github.com/apache/cocoon/blob/32a4e41183ba74351d85060011151b2d58acfc52/blocks/cocoon-forms/cocoon-forms-impl/src/main/java/org/apache/cocoon/forms/formmodel/CaptchaField.java
github	www.github.com/apache/cocoon/blob/32a4e41183ba74351d85060011151b2d58acfc52/core/cocoon-sitemap/cocoon-sitemap-impl/src/main/java/org/apache/cocoon/components/flow/ContinuationsManagerImpl.java
openwall	www.openwall.com/lists/oss-security/2025/01/27/3
github	www.github.com/advisories/GHSA-pff9-53m5-qr56

27 Jan 2025 21:34Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.17.5

EPSS0.01021

SSVC