| Package | Affected versions | Patched versions |
|---|---|---|
| http server | ≥ 2.4.0, ≤ 2.4.37 | |
| enterprise manager ops center | = 12.3.3 |
In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free