The vulnerability of the mod_session module in the Apache HTTP Server, related to the lack of consideration for the lifetime of a session, allows attackers to compromise the integrity of protected data.

🗓️ 25 Apr 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

The Apache mod_session flaw lacks session lifetime and timeout checks before decoding data, risking data integrity.

Reporter	Title	Published	Views	Family All 160
ALT Linux	Security fix for the ALT Linux 8 package apache2 version 1:2.4.38-alt1	28 Jan 201900:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package apache2 version 1:2.4.38-alt1	25 Jan 201900:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 9 package apache2 version 1:2.4.38-alt1	25 Jan 201900:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Rational Build Forge Security Advisory for Apache HTTP Server (CVE-2019-0190; CVE-2018-17189; CVE-2018-17199)	28 Mar 201907:00	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in httpd (CVE-2018-17199 and CVE-2018-1301).	22 Sep 202123:38	–	ibm
IBM Security Bulletins	WebSphere Application Server and IBM HTTP Server Security Bulletin List	13 Jul 202218:04	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache HTTP (CVE-2018-17199 and CVE-2020-11993) affects HMC	22 Nov 202106:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security SiteProtector System is affected by Apache HTTP Server vulnerabilities	5 Sep 201904:18	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability in the IBM HTTP Server (CVE-2018-17199)	13 Mar 201920:35	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in IBM HTTP Server shipped with IBM Rational ClearQuest (CVE-2018-17199)	2 Apr 201916:35	–	ibm

Vulners

Node

oracle enterprise_manager_ops_centerMatch12.3.3

OR

apache http_serverRange2.4.0–2.4.37

OR

oracle retail_xstore_point_of_serviceMatch7.0

OR

oracle instantis_enterprisetrackMatch17.1

OR

oracle instantis_enterprisetrackMatch17.2

OR

oracle instantis_enterprisetrackMatch17.3

OR

oracle retail_xstore_point_of_serviceMatch7.1

OR

canonical ubuntuMatch18.10

Source	Link
httpd	www.httpd.apache.org/security/vulnerabilities_24.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-17199
security-tracker	www.security-tracker.debian.org/tracker/CVE-2018-17199
abf	www.abf.rosalinux.ru/advisories/ROSA-SA-2023-2159
wiki	www.wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16
abf	www.abf.rosa.ru/advisories/ROSA-SA-2025-2900
abf	www.abf.rosa.ru/advisories/ROSA-SA-2025-2899
web	www.web.nvd.nist.gov/view/vuln/detail

19 Aug 2025 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 37.5

CVSS 27.8

EPSS0.10459

mod session vulnerability session lifetime timeout checks data decoding data integrity