CVE-2018-1283

CWE-20 — Improper Input Validation14 documents8 sources
Severity
5.3MEDIUM
EPSS
3.3%
top 12.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Apache Http ServerApache Software Foundation Apache Http ServerCanonical Ubuntu Linux+2 more
Timeline
PublishedMar 26
Latest updateJan 13

Description

In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header. This comes from the "HTTP_SESSION" variable name used by mod_session to forward its data to CGIs, since the prefix "HTTP_" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 1.6 | Impact: 3.6

Affected Packages3 packages

▶NVDapache/http_server2.4.0 — 2.4.29
▶Debianapache2< 2.4.33-1+3

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 14.04, 16.04, 17.10, 18.04, Enterprise Linux 6.0, 7.0, 7.4, 7.5, 7.6

🔴Vulnerability Details

6
OSV
libxmltok vulnerabilities↗2025-01-13
▶
OSV
libxmltok vulnerabilities↗2022-07-19
▶
GHSA
GHSA-69h6-845f-grx4: In Apache httpd 2↗2022-05-13
▶
OSV
apache2 vulnerabilities↗2018-04-19
▶
CVEList
CVE-2018-1283: In Apache httpd 2↗2018-03-26
▶

📋Vendor Advisories

4
Ubuntu
Apache HTTP Server vulnerabilities↗2018-04-30
▶
Ubuntu
Apache HTTP Server vulnerabilities↗2018-04-19
▶
Red Hat
httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for CGI applications↗2018-03-21
▶
Debian
CVE-2018-1283: apache2 - In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its s...↗2018
▶

💬Community

3
Bugzilla
CVE-2018-1000805 python-paramiko: Authentication bypass in auth_handler.py↗2018-10-09
▶
Bugzilla
CVE-2018-1283 httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for CGI applications [fedora-all]↗2018-03-26
▶
Bugzilla
CVE-2018-1283 httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for CGI applications↗2018-03-26
▶
CVE-2018-1283 (MEDIUM CVSS 5.3) | In Apache httpd 2.4.0 to 2.4.29 | cvebase.io