CVE-2018-1283: Apache HTTP Server

Medium severity, CVSS 5.3. EPSS: 9.7% chance of exploitation in the next 30 days.

In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header. This comes from the "HTTP_SESSION" variable name used by mod_session to forward its data to CGIs, since the prefix "HTTP_" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications.

Affected products

• Apache HTTP Server: from 2.4.0, up to and including 2.4.29
• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 17.10 only; version 18.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only
• Netapp Clustered Data Ontap: affected versions not specified
• Netapp Santricity Cloud Connector: affected versions not specified
• Netapp Storage Automation Store: affected versions not specified
• Netapp Storagegrid: affected versions not specified
• Red Hat Enterprise Linux: version 6.0 only; version 7.0 only; version 7.4 only; version 7.5 only; version 7.6 only

Published 2018-03-26. Last modified 2026-06-17.