CVE-2004-1834
Description
mod_disk_cache in Apache 2.0 through 2.0.49 stores client headers, including authentication information, on the hard disk, which could allow local users to gain sensitive information.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Apache mod_disk_cache in versions 2.0 to 2.0.49 stores client authentication headers in plaintext on disk, allowing local users to obtain sensitive credentials.
Vulnerability
Apache mod_disk_cache in versions 2.0 through 2.0.49 writes client request headers, including Proxy-Authorization and Authorization headers, to disk cache files. For Basic Authentication, passwords are stored in plaintext [2].
Exploitation
An attacker with local access to the file system where cache files are stored (e.g., the default cache directory) can read these files. No authentication or user interaction is required beyond local access [2].
Impact
Successful exploitation leads to disclosure of authentication credentials, including usernames and plaintext passwords for HTTP Basic Authentication, potentially allowing the attacker to impersonate legitimate users.
Mitigation
No official patch was included in Apache 2.0.49. Red Hat issued an advisory (RHSA-2004-562) [3] providing a fix. Administrators should upgrade to a patched version or disable mod_disk_cache if not required. Note that mod_disk_cache was experimental and later superseded.
AI Insight generated on May 24, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
21cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:*+ 19 more
- cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.28:beta:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.43:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.44:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.45:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.46:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.47:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.48:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.49:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.9:*:*:*:*:*:*:*
- Range: >=2.0, <=2.0.49
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
25- www.securityfocus.com/bid/9933nvdPatchVendor Advisory
- secunia.com/advisories/11176nvdExploitVendor Advisory
- securitytracker.com/idnvdExploitVendor Advisory
- www.osvdb.org/4446nvdExploitVendor Advisory
- marc.infonvd
- secunia.com/advisories/19072nvd
- sunsolve.sun.com/search/document.donvd
- support.avaya.com/elmodocs2/security/ASA-2006-081.htmnvd
- www.redhat.com/support/errata/RHSA-2004-562.htmlnvd
- www.vupen.com/english/advisories/2006/0789nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/15547nvd
- lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3Envd
- lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3Envd
- lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3Envd
- lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3Envd
- lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3Envd
- lists.apache.org/thread.html/r734a07156abf332d5ab27fb91d9d962cacfef4f3681e44056f064fa8%40%3Ccvs.httpd.apache.org%3Envd
- lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3Envd
- lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165%40%3Ccvs.httpd.apache.org%3Envd
- lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3Envd
- lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Envd
- lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3Envd
- lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3Envd
- lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Envd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11133nvd
News mentions
0No linked articles in our index yet.