CVE-2025-24783 json
Apache Cocoon: continuations may not be private
published 2025-01-27 21 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-0182 , GHSA-pff9-53m5-qr56
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 58%
- public exploits
- 0
- none known
Summary
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Apache Cocoon.
This issue affects Apache Cocoon: all versions.
When a continuation is created, it gets a random identifier. Because the random number generator used to generate these identifiers was seeded with the startup time, it may not have been sufficiently unpredictable, and an attacker could use this to guess continuation ids and look up continuations they should not have had access to.
As a mitigation, you may enable the "session-bound-continuations" option to make sure continuations are not shared across sessions.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
0.85% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.cocoon:cocoon-forms-impl | <=2.3.0 |
no fix listed |
| maven | org.apache.cocoon:cocoon-sitemap-impl | <=2.3.0 |
no fix listed |
Affected products
- Apache Software Foundation Apache Cocoon
Classification
- Weakness
-
- CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
References
-
lists.apache.org
/thread/pk86jp5cvn41432op8wv1k8p14mp27nz
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2025/01/27/3
web, mailing-list, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-24783
advisory
-
github.com
/apache/cocoon
package
-
github.com
/apache/cocoon/blob/32a4e41183ba74351d85060011151b2d58acfc52/blocks/cocoon-forms/cocoon-forms-impl/src/main/ja
web
-
github.com
/apache/cocoon/blob/32a4e41183ba74351d85060011151b2d58acfc52/core/cocoon-sitemap/cocoon-sitemap-impl/src/main/
web
Sources
- CVE List CVE-2025-24783
- GitHub Advisory GHSA-pff9-53m5-qr56
- NVD CVE-2025-24783
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.