CyberRota Analysis
AI-GeneratedVersions of GD::SecurityImage up to 1.75 for Perl are vulnerable due to the use of the built-in rand function to generate CAPTCHA challenge text, resulting in predictable and reversible outputs. This vulnerability could allow attackers to bypass CAPTCHA protections, potentially leading to automated abuse of web applications. Developers and security teams utilizing GD::SecurityImage for CAPTCHA implementations should prioritize addressing this issue to enhance the security of their applications.
Original NVD Description
GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string. The built-in rand function is unsuitable for security applications because it is predictable and reversible.