Vulnerability CVE-2018-17199
Published: 2019-01-30

Description:
In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.

Type:

CWE-384

 (Session Fixation)

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Oracle -> Enterprise manager ops center 
Netapp -> Santricity cloud connector 
Netapp -> Storage automation store 
Debian -> Debian linux 
Canonical -> Ubuntu linux 
Apache -> Http server 

 References:
http://www.securityfocus.com/bid/106742
https://httpd.apache.org/security/vulnerabilities_24.html
https://lists.debian.org/debian-lts-announce/2019/01/msg00024.html
https://seclists.org/bugtraq/2019/Apr/5
https://security.gentoo.org/glsa/201903-21
https://security.netapp.com/advisory/ntap-20190125-0001/
https://usn.ubuntu.com/3937-1/
https://www.debian.org/security/2019/dsa-4422
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Copyright 2024, cxsecurity.com

 

Back to Top