CVE-2018-1283 Information
Share on:Description
In Apache httpd 2.4.0 to 2.4.29 when mod_session is configured to forward its session data to CGI applications (SessionEnv on not the default) a remote user may influence their content by using a \Session\ header. This comes from the \HTTP_SESSION\ variable name used by mod_session to forward its data to CGIs since the prefix \HTTP_\ is also used by the Apache HTTP Server to pass HTTP header fields per CGI specifications.
CVSS Vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Reference
http://www.openwall.com/lists/oss-security/2018/03/24/4 http://www.securityfocus.com/bid/103520 http://www.securitytracker.com/id/1040568 https://access.redhat.com/errata/RHSA-2018:3558 https://access.redhat.com/errata/RHSA-2019:0366 https://access.redhat.com/errata/RHSA-2019:0367 https://httpd.apache.org/security/vulnerabilities_24.html https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@3Ccvs.httpd.apache.org3E https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@3Ccvs.httpd.apache.org3E https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@3Ccvs.httpd.apache.org3E https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@3Ccvs.httpd.apache.org3E https://security.netapp.com/advisory/ntap-20180601-0004/ https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us https://usn.ubuntu.com/3627-1/ https://usn.ubuntu.com/3627-2/ https://www.debian.org/security/2018/dsa-4164 https://www.tenable.com/security/tns-2019-09
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction Required
LOW
Scope
NONE
Confidentiality Impact
UNCHANGED
Integrity Impact
NONE
Availability Impact
HIGH
Base Score
NONE
Base Severity
5.3