UpHeron
All vulnerabilities

Servers and applications

CVE-2018-1283

In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header. This comes from the "HTTP_SESSION" variable name used by mod_session to forward its data to CGIs, since the prefix "HTTP_" is also used by the Apache HTTP Server to pass HTTP header…

Severity
Medium 5.3
Published
26 Mar 2018
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache HTTP ServerServers and applications · cpe:a:apache:http_server
  • From 2.4.0 up to 2.4.29

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-1283
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-1283