Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-52322

WebService::Xero 0.11 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically WebService::Xero uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function.

Published

2025-04-05T17:15:39.513

Last Modified

2025-11-13T14:34:51.550

Status

Analyzed

Source

9b29abf9-4ab0-4765-b253-1875cd9b441e

Severity

CVSSv3.1: 5.5 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-331
    CWE-338
  • Type: Primary
    CWE-338
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application localshop webservice\ ≤ 0.11 Yes
References