CVE-2018-1283

Name of the Vulnerable Software and Affected Versions Apache httpd versions 2.4.0 through 2.4.29

Description The issue arises when mod session is configured to forward its session data to CGI applications, allowing a remote user to influence their content by using a "Session" header. This is due to the "HTTP SESSION" variable name used by mod session, which conflicts with the prefix "HTTP " used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications.

Recommendations For Apache httpd versions 2.4.0 through 2.4.29, consider disabling the mod session module or setting SessionEnv to off to prevent the exploitation of this issue. As a temporary workaround, restrict access to CGI applications that use the HTTP SESSION variable until a patch is available.