CVE-2003-0789

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 12.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2003-11-03 · updated 2026-06-16

Description

mod_cgid in Apache before 2.0.48, when using a threaded MPM, does not properly handle CGI redirect paths, which could cause Apache to send the output of a CGI program to the wrong client.

Affected products

Apache HTTP Server: from 2.0.35 before 2.0.48 — fixed in 2.0.48

How to fix

Upgrade to a fixed version: Apache HTTP Server 2.0.48. Check the vendor advisory for mitigations.

References

http://apache.secsup.org/dist/httpd/Announcement2.html
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000775
http://docs.info.apple.com/article.html?artnum=61798
http://lists.apple.com/archives/security-announce/2004/Jan/msg00000.html
http://lists.apple.com/mhonarc/security-announce/msg00045.html
http://marc.info/?l=bugtraq&m=106761802305141&w=2
http://security.gentoo.org/glsa/glsa-200310-04.xml
http://www.ciac.org/ciac/bulletins/o-015.shtml
http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:103
http://www.redhat.com/support/errata/RHSA-2003-320.html
http://www.securityfocus.com/advisories/6079
http://www.securityfocus.com/bid/8926

Get alerted when CVE-2003-0789 or the next vulnerability affects your stack