CVE-2018-1283

CVE-2018-1283 is a medium-severity vulnerability affecting Apache httpd versions 2.4.0 to 2.4.29, along with various distributions like Debian and Red Hat. When mod_session is configured to forward session data to CGI applications (SessionEnv on), a remote, low-privileged attacker can manipulate session content by injecting a "Session" header. This is due to a conflict between mod_session's "HTTP_SESSION" variable and Apache's use of the "HTTP_" prefix for HTTP headers. The vulnerability has a CVSS score of 5.3, indicating a network-based attack with high complexity but requiring low privileges to achieve a high impact on integrity, with no impact on confidentiality or availability. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage are minimal, suggesting limited attention to this specific CVE.