Pseudo-Random Number Generator Flaw in Apache Cocoon by Apache

CVE-2025-24783

Summary

A vulnerability exists in Apache Cocoon due to an incorrect implementation of the pseudo-random number generator (PRNG) used for generating continuation identifiers. The randomness was compromised by seeding the PRNG with the startup time, which may lead to insufficient unpredictability. Consequently, attackers could potentially guess continuation IDs, granting them unauthorized access to sensitive information. As Apache Cocoon is a retired project, no official fixes are available; therefore, users are advised to either adopt alternative solutions or restrict access strictly to trusted users. Enabling the 'session-bound-continuations' option can mitigate exposure by ensuring continuity identifiers are not shared across different user sessions.

References