CVE-2018-17199

In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session

published January 30, 2019

CVSS
—
EPSS
20%
Percentile
97.5
In the wild
Unconfirmed
What it is

In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.20156 · 97.5th percentile
Published
2019-01-30T22:00Z
EPSS history
Timeline
  • 30 JAN 22:00Z
    In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session
    cvelistv5