CVE-2016-1000104 Security feature bypass in n/a

High 8.8 Published 3 Dec 2019 Updated 6 Aug 2024

Attackers can bypass security controls in the mod_fcgid module via the FcgidPassHeader Proxy, potentially exposing protected resources.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2016-1000104?

CVE-2016-1000104 is a high-severity vulnerability in Opensuse Leap, published on 3 Dec 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.

Weakness: CWE-20

Which versions are affected by CVE-2016-1000104?

It affects 3 products.

Linux distribution packages (1)

apache2-mod_fcgid SUSE:Linux Enterprise Software Development Kit 11 SP4 All versions 2.2-31.29.1

Products include Apache Mod Fcgid, Opensuse Leap, Opensuse Opensuse.

How do I fix CVE-2016-1000104?

Apply the vendor's patch.

Is CVE-2016-1000104 being exploited?

There is no known exploitation of CVE-2016-1000104 in the wild and no public exploit code.

All Opensuse Leap vulnerabilities

Sources

Also known as AZL-36963, AZL-7290, GHSA-3qww-55h8-4xjp, MGASA-2017-0203, OESA-2022-1758, SUSE-SU-2016:1820-1 and 1 more.