In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.

  • Published Date: Wednesday 30th of January 2019 05:29:00 PM
  • Modified Date: Friday 5th of April 2019 01:29:02 AM
    • Network Access Vector: The attacker does not require local network access or local access.
    • Authentication Vector: Authentication is not required to access and exploit the vulnerability.
    • Complexity Vector: The attack can be performed manually and requires little skill or additional information gathering.
    • Availability Impact: There is no impact to the availability of the system.
    • Integrity Impact: Modification of some system files is posible.
    • Confidentiality Impact: There is none information disclosure.
    • CVSS Score: 5.0
    • Common Platform Enumeration (CPE) Dictionary
      • cpe:2.3:a:apache:http_server:2.4.0
      • cpe:2.3:a:apache:http_server:2.4.1
      • cpe:2.3:a:apache:http_server:2.4.2
      • cpe:2.3:a:apache:http_server:2.4.3
      • cpe:2.3:a:apache:http_server:2.4.4
      • cpe:2.3:a:apache:http_server:2.4.6
      • cpe:2.3:a:apache:http_server:2.4.7
      • cpe:2.3:a:apache:http_server:2.4.8
      • cpe:2.3:a:apache:http_server:2.4.9
      • cpe:2.3:a:apache:http_server:2.4.10
      • cpe:2.3:a:apache:http_server:2.4.12
      • cpe:2.3:a:apache:http_server:2.4.14
      • cpe:2.3:a:apache:http_server:2.4.16
      • cpe:2.3:a:apache:http_server:2.4.17
      • cpe:2.3:a:apache:http_server:2.4.18
      • cpe:2.3:a:apache:http_server:2.4.19
      • cpe:2.3:a:apache:http_server:2.4.20
      • cpe:2.3:a:apache:http_server:2.4.21
      • cpe:2.3:a:apache:http_server:2.4.22
      • cpe:2.3:a:apache:http_server:2.4.23
      • cpe:2.3:a:apache:http_server:2.4.24
      • cpe:2.3:a:apache:http_server:2.4.25
      • cpe:2.3:a:apache:http_server:2.4.26
      • cpe:2.3:a:apache:http_server:2.4.27
      • cpe:2.3:a:apache:http_server:2.4.28
      • cpe:2.3:a:apache:http_server:2.4.29
      • cpe:2.3:a:apache:http_server:2.4.30
      • cpe:2.3:a:apache:http_server:2.4.32
      • cpe:2.3:a:apache:http_server:2.4.33
      • cpe:2.3:a:apache:http_server:2.4.34
      • cpe:2.3:a:apache:http_server:2.4.35
      • cpe:2.3:a:apache:http_server:2.4.36
      • cpe:2.3:a:apache:http_server:2.4.37
      • cpe:2.3:o:debian:debian_linux:8.0
      • cpe:2.3:o:debian:debian_linux:9.0
      • cpe:2.3:a:netapp:santricity_cloud_connector
      • cpe:2.3:a:netapp:storage_automation_store
      • cpe:2.3:o:canonical:ubuntu_linux:14.04:-:-:-:lts
      • cpe:2.3:o:canonical:ubuntu_linux:16.04:-:-:-:lts
      • cpe:2.3:o:canonical:ubuntu_linux:18.04:-:-:-:lts
      • cpe:2.3:o:canonical:ubuntu_linux:18.10
    • Reference:

    Download Mageni's Vulnerability Scanning Platform.

    No credit card is required to download the Free Edition. Register now.