← Vulnerability feed

Vulnerability record · CVE-2025-24783 · published 27 January 2025

CVE-2025-24783: Apache cocoon vulnerability

Apache · Cocoon

** UNSUPPORTED WHEN ASSIGNED ** Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. When a continuation is created, it gets a random identifier. Because the random number generator used to generate these identifiers was seeded with the startup time, it may not have been sufficiently unpredictable, and an attacker could use this to guess continuation ids and look up continuations they should not have had access to. As a mitigation, you may enable the "session-bound-continuations" option to make sure continuations are not shared across sessions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

7.5 CVSS 3.1 High EPSS 0.79% · top 45.6% CWE-335 · CWE-335
7.5CVSS 3.1 base score
0.79%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

** UNSUPPORTED WHEN ASSIGNED ** Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. When a continuation is created, it gets a random identifier. Because the random number generator used to generate these identifiers was seeded with the startup time, it may not have been sufficiently unpredictable, and an attacker could use this to guess continuation ids and look up continuations they should not have had access to. As a mitigation, you may enable the "session-bound-continuations" option to make sure continuations are not shared across sessions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://lists.apache.org/thread/pk86jp5cvn41432op8wv1k8p14mp27nz Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2025/01/27/3 Mailing ListThird Party Advisory

Track CVE-2025-24783 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-49733Apache cocoon xml external entity (xxe) vulnerabilityImproper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users…EPSS 1.3%9.8CVE-2022-45135Apache cocoon sql injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Cocoon.This issue affects Apache Cocoon:…EPSS 1.1%7.5CVE-2020-11991Apache Cocoon StreamGenerator XML external entity file disclosureApache Cocoon's StreamGenerator parses user-supplied XML without disabling external system entities, allowing XML External Entity (XXE) injection. An…EPSS 72%analysed5.0CVE-2003-1172Apache cocoon vulnerabilityDirectory traversal vulnerability in the view-source sample file in Apache Software Foundation Cocoon 2.1 and 2.2 allows remote attackers to access a…EPSS 31%

Source: NIST National Vulnerability Database (record CVE-2025-24783), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.