CVE-2001-1534
mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable...
mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication.
Exploit likelihood
What each source reports
NVD Score used
mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication.
- Record
CVE-2001-1534- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
CVE List No score
mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication.
- Record
CVE-2001-1534- Updated
- 2026-11-02
EUVDEUVD-2001-1511 No score
mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication.
- Record
EUVD-2001-1511- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gp27-vhqc-jqvp No score
mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable...
mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication.
- Record
GHSA-gp27-vhqc-jqvp- Weakness
- CWE-384
- Updated
- 2026-11-02
OSV No score
mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication.
- Record
CVE-2001-1534- Updated
- 2026-11-02
OSVDEBIAN-CVE-2001-1534 No score
mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication.
- Record
DEBIAN-CVE-2001-1534- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache2Debian:12 |
All versions, plus listed versions 2.4.57-22.4.57-32.4.58-12.4.59-12.4.59-1~deb10u1 Show 45 moreShow less2.4.59-1~deb11u12.4.59-1~deb12u12.4.59-22.4.60-12.4.61-12.4.61-1~deb11u12.4.61-1~deb12u12.4.62-12.4.62-1~deb11u12.4.62-1~deb11u22.4.62-1~deb12u12.4.62-1~deb12u22.4.62-22.4.62-32.4.62-42.4.62-52.4.62-62.4.63-12.4.64-12.4.65-12.4.65-1~deb11u12.4.65-1~deb12u12.4.65-22.4.65-32.4.66-12.4.66-1~deb11u12.4.66-1~deb12u12.4.66-1~deb12u22.4.66-1~deb13u12.4.66-1~deb13u22.4.66-22.4.66-32.4.66-42.4.66-52.4.66-62.4.66-72.4.66-82.4.67-12.4.67-1~deb11u12.4.67-1~deb11u22.4.67-1~deb11u32.4.67-1~deb12u12.4.67-1~deb12u22.4.67-1~deb12u32.4.67-1~deb13u1 |
None known |
apache2Debian:13 |
All versions, plus listed versions 2.4.65-22.4.65-32.4.66-12.4.66-1~deb11u12.4.66-1~deb12u1 Show 27 moreShow less2.4.66-1~deb12u22.4.66-1~deb13u12.4.66-1~deb13u22.4.66-22.4.66-32.4.66-42.4.66-52.4.66-62.4.66-72.4.66-82.4.67-12.4.67-1~deb11u12.4.67-1~deb11u22.4.67-1~deb11u32.4.67-1~deb12u12.4.67-1~deb12u22.4.67-1~deb12u32.4.67-1~deb13u12.4.67-1~deb13u22.4.67-1~deb13u32.4.67-22.4.68-12.4.68-1~deb12u12.4.68-1~deb13u12.4.68-22.4.69-12.4.69-1~deb13u1 |
None known |
apache2Debian:14 |
All versions, plus listed versions 2.4.65-22.4.65-32.4.66-12.4.66-1~deb11u12.4.66-1~deb12u1 Show 27 moreShow less2.4.66-1~deb12u22.4.66-1~deb13u12.4.66-1~deb13u22.4.66-22.4.66-32.4.66-42.4.66-52.4.66-62.4.66-72.4.66-82.4.67-12.4.67-1~deb11u12.4.67-1~deb11u22.4.67-1~deb11u32.4.67-1~deb12u12.4.67-1~deb12u22.4.67-1~deb12u32.4.67-1~deb13u12.4.67-1~deb13u22.4.67-1~deb13u32.4.67-22.4.68-12.4.68-1~deb12u12.4.68-1~deb13u12.4.68-22.4.69-12.4.69-1~deb13u1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2001-1534 is a low vulnerability (CVSS 2.1) in Apache Http Server, published December 31, 2001. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.76%, the 55th percentile. No source names a fixed version.
References
Left out here: 9 versions. The JSON record has them.