In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured…
Apache Software Foundation · Apache HTTP Server
The flaw is in the mod_session_crypto component of the Apache HTTP Server, affecting versions 2.4.0 through 2.4.23, where session data and cookies were encrypted with CBC or ECB modes (AES256-CBC by default) and no authenticated encryption was available. An attacker able to submit data to the server and observe its responses could exploit this through padding oracle attacks, particularly against CBC mode, to recover or manipulate the protected session content.
In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 6 years after disclosure. Public exploit code (Exploit-DB) was available 7 months before disclosure.
- Public exploit codeExploit-DB7 mo before
- Disclosedday 0
- First seen exploitedVulnCheck KEV evidence+6 yrs
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 3 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- smtech.hr - 194.135.80.88 - #FANOS - vuln to 24 CVE's19 May 2022
- SMS Phisphing Campaign16 May 2022
- Internal CVE Research9 Mar 2022