In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header. This comes from the "HTTP_SESSION" variable name used by mod_session to forward its data to CGIs, since the prefix "HTTP_" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-apache2 | Apr 2, 2018 | Mar 26, 2018 | |
| Amazon_linux | — | amazon-linux-upgrade-httpd24 | May 4, 2018 | Mar 23, 2018 |
| Apache Httpd | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | apache-httpd-upgrade-latest | Mar 26, 2018 | Mar 26, 2018 |
| Arch Linux | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | arch-linux-upgrade-latest | Jul 11, 2025 | Mar 26, 2018 |
| Centos_linux | — | centos-upgrade-httpdcentos-upgrade-httpd-debuginfocentos-upgrade-httpd-develcentos-upgrade-httpd-manualcentos-upgrade-httpd-toolscentos-upgrade-mod_ldapcentos-upgrade-mod_proxy_htmlcentos-upgrade-mod_sessioncentos-upgrade-mod_ssl | Oct 1, 2020 | Mar 26, 2018 |
| Debian | debian-upgrade-apache2 | Apr 4, 2018 | Mar 23, 2018 | |
| Freebsd | freebsd-upgrade-package-apache24freebsd-upgrade-package-apache22 | Mar 25, 2018 | Mar 24, 2018 | |
| Hpux | — | hpux-update-hpuxwsapache | Mar 28, 2022 | Mar 26, 2018 |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-httpdhuawei-euleros-2_0_sp2-upgrade-httpd-develhuawei-euleros-2_0_sp2-upgrade-httpd-manualhuawei-euleros-2_0_sp2-upgrade-httpd-toolshuawei-euleros-2_0_sp2-upgrade-mod_ssl | Dec 4, 2019 | Mar 26, 2018 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-httpdhuawei-euleros-2_0_sp3-upgrade-httpd-develhuawei-euleros-2_0_sp3-upgrade-httpd-manualhuawei-euleros-2_0_sp3-upgrade-httpd-toolshuawei-euleros-2_0_sp3-upgrade-mod_ssl | Dec 18, 2019 | Mar 26, 2018 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-httpdhuawei-euleros-2_0_sp5-upgrade-httpd-develhuawei-euleros-2_0_sp5-upgrade-httpd-manualhuawei-euleros-2_0_sp5-upgrade-httpd-toolshuawei-euleros-2_0_sp5-upgrade-mod_sessionhuawei-euleros-2_0_sp5-upgrade-mod_ssl | Nov 19, 2019 | Mar 26, 2018 | |
| Ibm Http_server | — | ibm-http_server-apply-fix-pack-9_0_0_8 | Aug 6, 2018 | Mar 26, 2018 |
| Oracle Solaris | oracle-solaris-11-3-upgrade-web-server-apache-24-2-4-33-0-175-3-32-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-dbd-2-4-33-0-175-3-32-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ldap-2-4-33-0-175-3-32-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-lua-2-4-33-0-175-3-32-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ssl-2-4-33-0-175-3-32-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ssl-fips-140-2-4-33-0-175-3-32-0-3-0 | May 16, 2018 | Mar 26, 2018 | |
| Oracle_linux | — | oracle-linux-upgrade-httpdoracle-linux-upgrade-httpd-develoracle-linux-upgrade-httpd-manualoracle-linux-upgrade-httpd-toolsoracle-linux-upgrade-mod-ldaporacle-linux-upgrade-mod-proxy-htmloracle-linux-upgrade-mod-sessionoracle-linux-upgrade-mod-ssl | Oct 13, 2020 | Mar 21, 2018 |
| Redhat_linux | — | redhat-upgrade-httpdredhat-upgrade-httpd-debuginforedhat-upgrade-httpd-develredhat-upgrade-httpd-manualredhat-upgrade-httpd-toolsredhat-upgrade-mod_ldapredhat-upgrade-mod_proxy_htmlredhat-upgrade-mod_sessionredhat-upgrade-mod_ssl | Oct 1, 2020 | Mar 26, 2018 |
| Suse | — | suse-upgrade-apache2suse-upgrade-apache2-develsuse-upgrade-apache2-docsuse-upgrade-apache2-example-pagessuse-upgrade-apache2-preforksuse-upgrade-apache2-utilssuse-upgrade-apache2-worker | Apr 6, 2018 | Mar 23, 2018 |
| Ubuntu | ubuntu-upgrade-apache2-bin | Apr 25, 2018 | Mar 23, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub