In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header. This comes from the "HTTP_SESSION" variable name used by mod_session to forward its data to CGIs, since the prefix "HTTP_" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications.
https://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2018/03/24/4
http://www.securitytracker.com/id/1040568
http://www.securityfocus.com/bid/103520
https://www.debian.org/security/2018/dsa-4164
https://usn.ubuntu.com/3627-1/
https://usn.ubuntu.com/3627-2/
https://security.netapp.com/advisory/ntap-20180601-0004/
https://access.redhat.com/errata/RHSA-2018:3558
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us
https://access.redhat.com/errata/RHSA-2019:0367
https://access.redhat.com/errata/RHSA-2019:0366
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://www.tenable.com/security/tns-2019-09
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
Source: MITRE
Published: 2018-03-26
Updated: 2021-06-06
Type: NVD-CWE-noinfo
Base Score: 3.5
Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Impact Score: 2.9
Exploitability Score: 6.8
Severity: LOW
Base Score: 5.3
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Impact Score: 3.6
Exploitability Score: 1.6
Severity: MEDIUM