NetSight
IP …
medium5.3

CVE-2018-1283

In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user…

Impact

In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header. This comes from the "HTTP_SESSION" variable name used by mod_session to forward its data to CGIs, since the prefix "HTTP_" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications.

Affected products

VendorProductAffected versions
ApacheHttp Server
from 2.4.0 through 2.4.29
DebianDebian Linux
Versions 8.0, 9.0
CanonicalUbuntu Linux
Versions 14.04, 16.04, 17.10, 18.04
NetappSantricity Cloud Connector
All versions
NetappStorage Automation Store
All versions
NetappStoragegrid
All versions
NetappClustered Data Ontap
All versions
RedhatEnterprise Linux
Versions 6.0, 7.0, 7.4, 7.5, 7.6

References