| Package | Affected versions | Patched versions |
|---|---|---|
| http server | ≥ 2.4.60, < 2.4.69 | 2.4.69 |
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free