Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) Affecting org.apache.cocoon:cocoon-sitemap-impl package, versions [0,]
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JAVA-ORGAPACHECOCOON-8663472
- published28 Jan 2025
- disclosed27 Jan 2025
- creditXiangfan Wu
Introduced: 27 Jan 2025
NewCVE-2025-24783 (opens in a new tab)How to fix?
There is no fixed version for org.apache.cocoon:cocoon-sitemap-impl.
Overview
Affected versions of this package are vulnerable to Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) in the ContinuationsManagerImpl class, which uses the application's startup time as the seed. An attacker can guess continuation IDs and access unauthorized continuations by predicting this value.
Note: This package is no longer maintained so a fix is not expected.
Workaround
This vulnerability can be avoided by enabling the session-bound-continuations option.