Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2004-0940

30
FAUCET Score

CVE-2004-0940 describes a buffer overflow vulnerability in the get_tag function of mod_include for Apache 1.3.x versions up to 1.3.32, affecting various distributions like HP, OpenPKG, Slackware, SUSE, and Trustix. This flaw allows local users with privileges to create Server Side Include (SSI) documents to execute arbitrary code as the Apache user due to a length calculation error. The vulnerability carries a high CVSS score of 7.8, indicating a high potential for impact including complete compromise of confidentiality, integrity, and availability, with a low attack complexity. While not listed in CISA's KEV catalog, public exploit code exists on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
>= 1.3, <= 1.3.32CPE matchmatch criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
2.0CPE matchmatch criteria
cpe:2.3:a:openpkg:openpkg:2.0:*:*:*:*:*:*:*
2.1CPE matchmatch criteria
cpe:2.3:a:openpkg:openpkg:2.1:*:*:*:*:*:*:*
2.2CPE matchmatch criteria
cpe:2.3:a:openpkg:openpkg:2.2:*:*:*:*:*:*:*
11.00CPE matchmatch criteria
cpe:2.3:o:hp:hp-ux:11.00:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.8HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.8
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
4.83%
Probability of exploitation in next 30 days
EPSS Percentile
91.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-24
Model: v2026.06.15
ExploitDB: EDB-587 · Oct 21, 2004
This CVE's current EPSS score of 0.0483 is in the 98th percentile among its peer group of 16,974 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (6)

redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux AS (Advanced Server) version 2.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux ES version 2.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux WS version 2.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Linux Advanced Workstation 2.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Stronghold 4
View patch
redhatpatch availablevia redhat_api
Product: Stronghold 4.0 for Red Hat Enterprise Linux AS (version 2.1)
View patch

Vendor Advisories (1)

redhatCVE-2004-0940Moderate

httpd mod_include SSI overflow

Oct 21, 2004

References

marc.info
Mailing ListThird Party Advisory
secunia.com / advisories/12898
Broken Link
secunia.com / advisories/19073
Broken Link
securitytracker.com / id
Broken LinkThird Party AdvisoryVDB Entry
exchange.xforce.ibmcloud.com / vulnerabilities/17785
Third Party AdvisoryVDB Entry
lists.apache.org / thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E
Mailing ListPatch
lists.apache.org / thread.html/r734a07156abf332d5ab27fb91d9d962cacfef4f3681e44056f064fa8%40%3Ccvs.httpd.apache.org%3E
Mailing ListPatch
lists.apache.org / thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E
Mailing ListPatch
lists.apache.org / thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3E
Mailing ListPatch
lists.apache.org / thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3E
Mailing ListPatch
lists.apache.org / thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3E
Mailing ListPatch
lists.apache.org / thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
Mailing ListPatch
sunsolve.sun.com / search/document.do
Broken Link
support.avaya.com / elmodocs2/security/ASA-2006-081.htm
Third Party Advisory
apacheweek.com / features/security-13
Product
debian.org / security/2004/dsa-594
Mailing ListThird Party Advisory
mandriva.com / security/advisories
Third Party Advisory
redhat.com / support/errata/RHSA-2004-600.html
Broken Link
redhat.com / support/errata/RHSA-2005-816.html
Broken Link
securityfocus.com / bid/11471
Broken LinkExploitPatchThird Party AdvisoryVDB EntryVendor Advisory
vupen.com / english/advisories/2006/0789
Broken Link