CVE-2026-13082

{
  "id": "CVE-2026-13082",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-07-17T13:17:55.443",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets.\n\nThe random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string.\n\nThe built-in rand function is unsuitable for security applications because it is predictable and reversible."
    },
    {
      "lang": "es",
      "value": "Las versiones de GD::SecurityImage hasta la 1.75 para Perl usan rand para generar secretos.\n\nEl método aleatorio crea el texto de desafío usado para el CAPTCHA muestreando caracteres de un array usando la función rand incorporada de Perl, y genera una cadena (por defecto) de seis caracteres.\n\nLa función rand incorporada no es adecuada para aplicaciones de seguridad porque es predecible y reversible."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "BURAK",
          "product": "GD::SecurityImage",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "GD-SecurityImage",
          "programFiles": [
            "lib/GD/SecurityImage.pm"
          ],
          "programRoutines": [
            {
              "name": "GD::SecurityImage::random"
            },
            {
              "name": "GD::SecurityImage::random_angle"
            },
            {
              "name": "GD::SecurityImage::particle"
            }
          ],
          "repo": "https://github.com/burak/CPAN-GD-SecurityImage",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.75",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-17T17:29:10.397745Z",
          "id": "CVE-2026-13082",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-338"
        },
        {
          "lang": "en",
          "value": "CWE-804"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://security.metacpan.org/patches/G/GD-SecurityImage/1.75/CVE-2026-13082-r1.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40916",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ]
}