PUBLISHED
2026-07-17 13:17
MODIFIED
2026-07-17 13:17
EPSS (Prob. Exploit)
0.31%
Top 77.8%
> DESCRIPTION
GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets.
The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string.
The built-in rand function is unsuitable for security applications because it is predictable and reversible.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) - The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. | CWE-804: Guessable CAPTCHA - The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets
AFFECTED PACKAGES:
Unknown / Unknown
5 versions affected
> HISTORIQUE DES MODIFICATIONS
Première apparition
17/07/2026 13:17
Source: NVD
📊
ENRICHISSEMENT
01/08/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) - The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptogra...
Total des modifications: 1
Dernière mise à jour: 3 months ago