Cyber Posture

CVE-2025-24783

High

Published: 27 January 2025

Published
27 January 2025
Modified
15 July 2025
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0102 77.4th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-24783 is a high-severity PRNG (CWE-335) vulnerability in Apache Cocoon. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 22.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Prohibits the use of unsupported system components like retired Apache Cocoon, directly preventing exposure to this unpatchable PRNG seeding vulnerability.

prevent

Requires timely flaw remediation, including replacement of unsupported software with predictable PRNG identifiers to eliminate the vulnerability.

prevent

Mandates secure configuration settings such as enabling session-bound-continuations to restrict continuation access across sessions and mitigate ID guessing.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability allows remote unauthenticated attackers to exploit a public-facing Apache Cocoon web application by predicting continuation IDs due to weak PRNG seeding, directly enabling unauthorized data disclosure.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

** UNSUPPORTED WHEN ASSIGNED ** Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. When a continuation is created, it gets a random identifier. Because the random number generator…

more

used to generate these identifiers was seeded with the startup time, it may not have been sufficiently unpredictable, and an attacker could use this to guess continuation ids and look up continuations they should not have had access to. As a mitigation, you may enable the "session-bound-continuations" option to make sure continuations are not shared across sessions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Deeper analysisAI

CVE-2025-24783 is an Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability (CWE-335) affecting all versions of Apache Cocoon. The issue arises when continuations are created and assigned random identifiers using a PRNG seeded solely with the application's startup time, rendering the identifiers insufficiently unpredictable.

Remote attackers with no privileges required can exploit this over the network with low complexity and no user interaction (CVSSv3.1 score of 7.5: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). By guessing the predictable continuation IDs, they can access continuations that should be restricted, leading to unauthorized data disclosure.

Apache advisories note that as Cocoon is a retired project, no patched version will be released. Mitigation involves enabling the "session-bound-continuations" option to prevent sharing across sessions, alongside recommendations to migrate to alternatives or restrict instance access to trusted users only. This vulnerability exclusively impacts unsupported products.

Details

CWE(s)

Affected Products

apache
cocoon
all versions

CVEs Like This One

CVE-2024-55532Same vendor: Apache
CVE-2026-31908Same vendor: Apache
CVE-2025-54466Same vendor: Apache
CVE-2026-40466Same vendor: Apache
CVE-2026-24343Same vendor: Apache
CVE-2025-66614Same vendor: Apache
CVE-2026-29146Same vendor: Apache
CVE-2025-59059Same vendor: Apache
CVE-2025-61622Same vendor: Apache
CVE-2025-33042Same vendor: Apache

References