Description

In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC.

Remediation

References

CVE-2016-0736

Related Vulnerabilities

WordPress Plugin MailPoet Newsletters (Previous) Cross-Site Scripting (2.6.19)

TCExam Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2020-5743)

WebLogic Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-14572)

WordPress Plugin Hana Flv Player Cross-Site Scripting (3.1.3)

WordPress Plugin UpdraftPlus WordPress Backup Cross-Site Scripting (1.13.4)

Severity

High

Classification

CVE-2016-0736 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities