{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-13082","assignerOrgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","state":"PUBLISHED","assignerShortName":"CPANSec","dateReserved":"2026-06-23T18:17:08.243Z","datePublished":"2026-07-17T12:54:07.177Z","dateUpdated":"2026-07-17T17:29:23.536Z"},"containers":{"cna":{"affected":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","packageName":"GD-SecurityImage","product":"GD::SecurityImage","programFiles":["lib/GD/SecurityImage.pm"],"programRoutines":[{"name":"GD::SecurityImage::random"},{"name":"GD::SecurityImage::random_angle"},{"name":"GD::SecurityImage::particle"}],"repo":"https://github.com/burak/CPAN-GD-SecurityImage","vendor":"BURAK","versions":[{"lessThanOrEqual":"1.75","status":"affected","version":"0","versionType":"custom"}]}],"descriptions":[{"lang":"en","value":"GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets.\n\nThe random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string.\n\nThe built-in rand function is unsuitable for security applications because it is predictable and reversible."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-338","description":"CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-804","description":"CWE-804 Guessable CAPTCHA","lang":"en","type":"CWE"}]}],"providerMetadata":{"orgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","shortName":"CPANSec","dateUpdated":"2026-07-17T12:54:07.177Z"},"references":[{"tags":["related"],"url":"https://www.cve.org/CVERecord?id=CVE-2025-40916"},{"tags":["patch"],"url":"https://security.metacpan.org/patches/G/GD-SecurityImage/1.75/CVE-2026-13082-r1.patch"}],"source":{"discovery":"UNKNOWN"},"timeline":[{"lang":"en","time":"2018-12-24T00:00:00.000Z","value":"Version 1.75 released."},{"lang":"en","time":"2026-03-10T00:00:00.000Z","value":"The git repository was archived."}],"title":"GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets","workarounds":[{"lang":"en","value":"GD::SecurityImage has not been updated since 2018, the module is flagged as ADOPTME on CPAN, and the git repository is archived as read-only, which prevents issues and pull requests from being created.\n\nUsers are advised to find an alternative solution.\n\nFor users who are unable to migrate to an alternative, install Crypt::URandom::MonkeyPatch (which will override the built-in rand with a wrapper around Crypt::URandom) and apply the patch."}],"x_generator":{"engine":"cpansec-cna-tool 0.1"}},"adp":[{"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-07-17T17:29:10.397745Z","id":"CVE-2026-13082","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-07-17T17:29:23.536Z"}}]}}