Description
In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection.
Remediation
References
Related Vulnerabilities
WordPress Plugin Social Sharing-Social Warfare Cross-Site Scripting (3.5.3)
WordPress Plugin GigPress Cross-Site Scripting (2.3.27)
Apache Tomcat Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2018-1336)
Liferay Portal Cleartext Storage of Sensitive Information Vulnerability (CVE-2021-33325)