Request a Demo

Apache – CVE-2018-17199

Description

Kayran has detected that the Version of Apache HTTP Server being used is vulnerable to Session Fixation (CWE-384).
The Authenticating of a user, or establishing a new user session without invalidating any existing session identifiers. In short, the mod_session_cookie does not respect expiry time.
Also known as CVE-2018-17199.

In the Version of Apache HTTP server being used, mod_session checks the session expiry time before decoding the session itself.
This will lead to ignoring the session expiry time for mod_session_cookie sessions since the expiry time is being loaded in the time that the session is decoded.
That, will allow attackers to steal authenticated sessions from users.

There’s a chance that this vulnerability will allow attackers to modify system files and information.

Recommendation

To fix CVE-2018-17199, upgrade the version of Apache HTTP Server being used to 2.4.38 or higher.

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17199

https://cwe.mitre.org/data/definitions/384.html

< Return to all Vulnerabilities

Request a Demo

Crossing Scripts – XSS

Injections. SQL Injections. Cross-site Scripting (hence the amazing title “Crossing Scripts – XSS”). There all sorts of Injection-Based attacks, if you want to read about

Read More »

Blue Team

We’ve talked about The Red Team before, but what about The Blue Team? How is this group different from the red one? Why would we

Read More »

Active Directory Hacking

What does Active Directory mean? The Active Directory infrastructure is a critical infrastructure in most organizations, and it forms the backbone of the organization’s computing

Read More »
Facebook Linkedin

WEB APPLICATION VULNERABILITY SCANNER

Links

registered user?

Log in
Facebook Linkedin