Maven/org.apache.cocoon:cocoon-forms-impl CVE-2025-24783: low, EPSS 0.85%

Apache Cocoon vulnerable to Incorrect Usage of Seeds in Pseudo-Random Number Generator

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-pff9-53m5-qr56
• https://nvd.nist.gov/vuln/detail/CVE-2025-24783
• https://github.com/apache/cocoon
• https://github.com/apache/cocoon/blob/32a4e41183ba74351d85060011151b2d58acfc52/blocks/cocoon-forms/cocoon-forms-impl/src/main/java/org/apache/cocoon/forms/formmodel/CaptchaField.java#L70
• https://github.com/apache/cocoon/blob/32a4e41183ba74351d85060011151b2d58acfc52/core/cocoon-sitemap/cocoon-sitemap-impl/src/main/java/org/apache/cocoon/components/flow/ContinuationsManagerImpl.java#L112
• https://lists.apache.org/thread/pk86jp5cvn41432op8wv1k8p14mp27nz
• http://www.openwall.com/lists/oss-security/2025/01/27/3

CVE-2025-24783 · published 2025-01-27T15:30:58Z · modified 2025-01-27T21:47:02.903220Z · JSON