vulnwire
2.1low

CVE-2001-1534

mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time a…

Published 24 y ago · modified 4 mo ago · JSON

CVSS
2.1
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.8%
percentile 55%
Public exploits
0
none known

mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication.

Exploit prediction (EPSS)

0.76% probability of exploitation in the next 30 days, higher than 55% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.02.1AV:L/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
Technology feeds
Apache HTTP Server (RSS, critical only)

References

  • securityfocus.com /bid/3521 · vdb-entry, x_refsource_BID, x_transferred
  • iss.net /security_center/static/7494.php · vdb-entry, x_refsource_XF, x_transferred
  • cert.uni-stuttgart.de /archive/bugtraq/2001/11/msg00084.html · mailing-list, x_refsource_BUGTRAQ, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.