peter bassill · operator
$ cve CVE-2018-1312 JSON

CVE-2018-1312

9.8
CRITICAL · CVSS 3.1 · EPSS 15.7% (pctl 97)

Patch early

EPSS 15.7% — above the 10% action threshold.

Description

In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS15.72% — more likely to be exploited than 97% of all CVEs
WeaknessCWE-287
On CISA KEVno
Public exploitnone known
Published2018-03-26
Last modified2026-06-17

Affected (14)

VendorProduct
apachehttp server
canonicalubuntu linux
debiandebian linux
netappcloud backup
netappclustered data ontap
netappstoragegrid
redhatenterprise linux
redhatenterprise linux desktop
redhatenterprise linux eus
redhatenterprise linux server
redhatenterprise linux server aus
redhatenterprise linux server tus
redhatenterprise linux workstation
redhatjboss core services

References

→ the Explorer  ·  watch your stack  ·  NVD