CVE-2025-40916 Details
Description
Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha. That version uses the built-in rand() function for generating the captcha text as well as image noise, which is insecure.
A vulnerability exists in Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl, where a weak random number generator is used for creating captcha text and image noise. The plugin relies on the built-in rand() function, which is not secure for generating random data needed for captchas. This issue allows for potential prediction of captcha values, undermining the effectiveness of the captcha mechanism.
Users can upgrade to Mojolicious::Plugin::CaptchaPNG version 1.06 or later, which addresses this vulnerability by using Crypt::URandom for secure random number generation. Instructions for updating can be found on MetaCPAN.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 16, 2025CISA-ADP
Assessed Jun 16, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/pod/perlfunc#rand | CPANSec | |
| https://metacpan.org/release/GRYPHON/Mojolicious-Plugin-CaptchaPNG-1.04/diff/GRYPHON/Mojolicious-Plugin-CaptchaPNG-1.05/lib/Mojolicious/Plugin/CaptchaPNG.pm | CPANSec | Source CodeVendor |
| https://metacpan.org/release/GRYPHON/Mojolicious-Plugin-CaptchaPNG-1.06/changes | CPANSec | Release NotesVendor |
| https://security.metacpan.org/docs/guides/random-data-for-security.html | CPANSec | Technical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | CPANSec |
| CWE-804 | Guessable CAPTCHA | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| GRYPHON Mojolicious::Plugin::CaptchaPNG | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 16, 2025 | CVE Modified | CISA-ADP |
| Jun 16, 2025 | New CVE Received | CPANSec |