CVE-2024-58135

CVE-2024-58135 describes a vulnerability in Mojolicious versions from 7.28, where the "mojo generate app" tool creates default application skeletons with weak HMAC session cookie secrets. This weakness stems from using the insecure rand() function, making session keys susceptible to brute-force attacks. The vulnerability has a medium severity CVSS score of 5.3, indicating a network attack vector with low complexity, potentially leading to information disclosure. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.