Skip to content
fr Sign in
Not rated

CVE-2018-1283 In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications…

Description

In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header. This comes from the "HTTP_SESSION" variable name used by mod_session to forward its data to CGIs, since the prefix "HTTP_" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications.

Affected products and versions

Product Affected versions Fixed in
Apache HTTP Server Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache HTTP Server

The 139 CVEs of Apache HTTP Server →
CVE-2026-63686 A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all… Not rated CVE-2026-93546 Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write… Not rated CVE-2026-79768 Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when… Not rated CVE-2026-73637 Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows… Not rated
Track this CVE