CVE-2025-15578

Published: Feb 16, 2026Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the system time (which is available from HTTP response headers), a call to the built-in rand() function, and the PID.

Affected (3)

Products: Teejay: Maypole

Teejay

1 product

Maypole

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Teejay Maypole	From 2.10 to 2.13
Teejay Maypole	Version 2.111
Teejay Maypole	Version 2.121

Related CWEs

CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

References (1)

https://metacpan.org/dist/Maypole/source/lib/Maypole/Session.pm#L43

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Issue Tracking

Timeline

No history available yet.