Servers and applications
CVE-2004-0940
Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via SSI (XSSI) documents that trigger a length calculation error.
- Severity
- High 7.8
- Published
- 9 Feb 2005
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 17 Oct 2026
- Exploit chance
- 4.8% in the next 30 daysHigher than 92% of CVEs. EPSS by FIRST, 12 Nov 2026
- Weakness
- CWE-131
- Attack
- Needs local access · Needs a user account · No user action needed
- Attacker can
- Read data · Change data · Take it down
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Apache HTTP ServerServers and applications · cpe:a:apache:http_server |
|