CVE-2025-24783: Cocoon forms impl Apache Cocoon Vulnerable To Incorrect Vulnerability
LOWCVE-2025-24783 is a LOW apache cocoon vulnerable to incorrect vulnerability (CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)) affecting Cocoon forms impl libraries in the Maven ecosystem. The issue involves apache cocoon vulnerable to incorrect usage of seeds in pseudo-random number generator. Remediation is available in the latest vendor maintenance releases.
CVE-2025-24783 at a Glance
How to Fix CVE-2025-24783
To remediate this vulnerability, upgrade all affected Cocoon forms impl dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
<dependency>
<groupId>org.apache.cocoon</groupId>
<artifactId>cocoon-forms-impl</artifactId>
<version>Latest secure release</version>
</dependency><dependency>
<groupId>org.apache.cocoon</groupId>
<artifactId>cocoon-sitemap-impl</artifactId>
<version>Latest secure release</version>
</dependency>Run the following command in your project directory to verify that all resolved dependencies use the patched release:
mvn dependency:tree -Dincludes=org.apache.cocoonHow to Check if You Are Affected
To determine whether your Java application is affected by CVE-2025-24783, inspect your build dependencies using the Maven Dependency Plugin:
mvn dependency:tree -Dincludes=org.apache.cocoonAnalyze the terminal output to locate any version of Cocoon forms impl in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: The mvn dependency:tree -Dincludes=org.apache.cocoon command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG), where the product uses a pseudo-random number generator (prng) but does not correctly manage seeds. In Cocoon forms impl, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-24783 Affected Cocoon forms impl Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
org.apache.cocoon:cocoon-forms-impl
|
Maven |
≤ 2.3.0
|
|
|
org.apache.cocoon:cocoon-sitemap-impl
|
Maven |
≤ 2.3.0
|
|
References
Frequently Asked Questions
What is CVE-2025-24783?
Which Cocoon forms impl versions are affected?
What version fixes CVE-2025-24783?
Is cocoon-forms-impl affected?
Is cocoon-sitemap-impl affected?
What CWE is associated with CVE-2025-24783?
How can I check Maven dependencies for CVE-2025-24783?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-pff9-53m5-qr56",
"modified" : "2025-01-27T21:34:13Z",
"published" : "2025-01-27T15:30:58Z",
"aliases" : [ "CVE-2025-24783" ],
"summary" : "Apache Cocoon vulnerable to Incorrect Usage of Seeds in Pseudo-Random Number Generator",
"details" : "Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Apache Cocoon.\n\nThis issue affects Apache Cocoon: all versions.\n\nWhen a continuation is created, it gets a random identifier. Because the random number generator used to generate these identifiers was seeded with the startup time, it may not have been sufficiently unpredictable, and an attacker could use this to guess continuation ids and look up continuations they should not have had access to.\n\nAs a mitigation, you may enable the \"session-bound-continuations\" option to make sure continuations are not shared across sessions.\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Maven",
"name" : "org.apache.cocoon:cocoon-forms-impl"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "2.3.0"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Maven",
"name" : "org.apache.cocoon:cocoon-sitemap-impl"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "2.3.0"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-24783"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/apache/cocoon"
}, {
"type" : "WEB",
"url" : "https://github.com/apache/cocoon/blob/32a4e41183ba74351d85060011151b2d58acfc52/blocks/cocoon-forms/cocoon-forms-impl/src/main/java/org/apache/cocoon/forms/formmodel/CaptchaField.java#L70"
}, {
"type" : "WEB",
"url" : "https://github.com/apache/cocoon/blob/32a4e41183ba74351d85060011151b2d58acfc52/core/cocoon-sitemap/cocoon-sitemap-impl/src/main/java/org/apache/cocoon/components/flow/ContinuationsManagerImpl.java#L112"
}, {
"type" : "WEB",
"url" : "https://lists.apache.org/thread/pk86jp5cvn41432op8wv1k8p14mp27nz"
}, {
"type" : "WEB",
"url" : "http://www.openwall.com/lists/oss-security/2025/01/27/3"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-335" ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2025-01-27T17:22:59Z",
"nvd_published_at" : "2025-01-27T15:15:17Z"
}
}