WaratekVRT Sign in

CVE-2018-1283 Apache HTTP Server

Affected softwareApache HTTP Server
Severity5.3 Medium CVSS 3.0 2 scores
Published26 Mar 2018
Updated17 Jun 2026

Description

In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header. This comes from the "HTTP_SESSION" variable name used by mod_session to forward its data to CGIs, since the prefix "HTTP_" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 8 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 9.7% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

5.3 MEDIUM v3.0 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 5.3 MEDIUM CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N NVD Primary published
CVSS 2.0 3.5 none AV:N/AC:M/Au:S/C:N/I:P/A:N NVD Primary

Affected software and releases

Products and versions

8 products, 16 version entries
SourceVendorProductSchemeAffected versions
nvd apache http server generic ≥ 2.4.0 and ≤ 2.4.29
nvd canonical ubuntu linux generic 14.04 · 16.04 · 17.10 · 18.04
nvd debian debian linux generic 8.0 · 9.0
nvd netapp clustered data ontap generic any version
nvd netapp santricity cloud connector generic any version
nvd netapp storage automation store generic any version
nvd netapp storagegrid generic any version
nvd redhat enterprise linux generic 6.0 · 7.0 · 7.4 · 7.5 · 7.6

References

URLTags
http://www.openwall.com/lists/oss-security/2018/03/24/4 Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/103520 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040568 Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:3558 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0366 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0367 Third Party Advisory
https://httpd.apache.org/security/vulnerabilities_24.html Vendor Advisory
https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E

Timeline
Published2018-03-26By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.