CVE-2016-1000104
A security Bypass vulnerability exists in mod_fcgid through 2016-07-07 in the FcgidPassHeader Proxy.
A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.
- Record
CVE-2016-1000104- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.
- Record
CVE-2016-1000104- Updated
- 2026-11-02
EUVDEUVD-2016-1049 No score
A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.
- Record
EUVD-2016-1049- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3qww-55h8-4xjp
A security Bypass vulnerability exists in mod_fcgid through 2016-07-07 in the FcgidPassHeader Proxy.
A security Bypass vulnerability exists in mod_fcgid through 2016-07-07 in the FcgidPassHeader Proxy.
- Record
GHSA-3qww-55h8-4xjp- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVAZL-36963
CVE-2016-1000104 affecting package mod_fcgid 2.3.9-21
A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.
- Record
AZL-36963- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
OSVAZL-7290
CVE-2016-1000104 affecting package mod_fcgid 2.3.9-21
A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.
- Record
AZL-7290- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVOESA-2022-1758
mod_fcgid security update
Mod_fcgid is an Apache module providing a FastCGI interface. It's an alternative to mod_fastcgi that is specifically tuned for the dynamic FastCGI configuration used on DreamHost servers.
Security Fix(es):
A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.(CVE-2016-1000104)
- Record
OESA-2022-1758- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-1000104
A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.
- Record
UBUNTU-CVE-2016-1000104- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0203 No score
Updated apache-mod_fcgid packages fix security vulnerability
A remote attacker could have set the HTTP_PROXY environment variable of CGI scripts (CVE-2016-1000104).
- Record
MGASA-2017-0203- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10564-1 No score
apache2-mod_fcgid-2.3.9-7.3 on GA media
These are all security issues fixed in the apache2-mod_fcgid-2.3.9-7.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10564-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:1820-1 No score
Security update for apache2-mod_fcgid
This update for apache2-mod_fcgid fixes the following issues:
- It used to be possible to set an arbitrary $HTTP_PROXY environment variable for request handlers -- like CGI scripts -- by including a specially crafted HTTP header in the request (CVE-2016-1000104). As a result, these server components would potentially direct all their outgoing HTTP traffic through a malicious proxy server. This patch fixes the issue: the updated Apache server ignores such HTTP headers and never sets $HTTP_PROXY for sub-processes (unless a value has been explicitly configured by the administrator in the configuration file). (bsc#988492)
- Record
SUSE-SU-2016:1820-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mod_fcgidAzure Linux:3 |
through 2.3.9-21 | None known |
mod_fcgidAzure Linux:2 |
through 2.3.9-21 | None known |
apache-mod_fcgidMageia:5 |
before 2.3.9-4.1.mga5 | 2.3.9-4.1.mga5 |
mod_fcgidopenEuler:20.03-LTS-SP1 |
before 2.3.9-20.oe1 | 2.3.9-20.oe1 |
mod_fcgidopenEuler:20.03-LTS-SP3 |
before 2.3.9-20.oe1 | 2.3.9-20.oe1 |
mod_fcgidopenEuler:22.03-LTS |
before 2.3.9-21.oe2203 | 2.3.9-21.oe2203 |
apache2-mod_fcgidSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 2.2-31.29.1 | 2.2-31.29.1 |
libapache2-mod-fcgidUbuntu:16.04:LTS |
All versions, plus listed versions 1:2.3.9-1 |
None known |
libapache2-mod-fcgidUbuntu:18.04:LTS |
All versions, plus listed versions 1:2.3.9-1 |
None known |
libapache2-mod-fcgidUbuntu:20.04:LTS |
All versions, plus listed versions 1:2.3.9-4 |
None known |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libapache2-mod-fcgidUbuntu:22.04:LTS |
All versions, plus listed versions 1:2.3.9-4 |
None known |
libapache2-mod-fcgidUbuntu:24.04:LTS |
All versions, plus listed versions 1:2.3.9-4 |
None known |
libapache2-mod-fcgidUbuntu:25.10 |
All versions, plus listed versions 1:2.3.9-4 |
None known |
libapache2-mod-fcgidUbuntu:26.10 |
All versions, plus listed versions 1:2.3.9-4build1 |
None known |
libapache2-mod-fcgidUbuntu:26.04:LTS |
All versions, plus listed versions 1:2.3.9-41:2.3.9-4build1 |
None known |
apache2-mod_fcgidopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 2.3.9-7.3 | 2.3.9-7.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-1000104 is a high vulnerability (CVSS 8.8) in Apache Mod Fcgid, published July 18, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.23%, the 82nd percentile. Fixed in apache-mod_fcgid 2.3.9-4.1.mga5.
References
openwall.com/lists/oss-security/2016/07/18/6
lists.opensuse.org/opensuse-updates/2016-08/msg00084.html
securityfocus.com/bid/91822
tenable.com/security/tns-2017-04
nvd.nist.gov/vuln/detail/CVE-2016-1000104
bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000104
Show 15 moreShow less
bugzilla.suse.com/show_bug.cgi?id=CVE-2016-1000104
security-tracker.debian.org/tracker/CVE-2016-1000104
github.com/advisories/GHSA-3qww-55h8-4xjp
advisories.mageia.org/MGASA-2017-0203.html
bugs.mageia.org/show_bug.cgi?id=19237
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1758
suse.com/support/update/announcement/2016/suse-su-20161820-1
ubuntu.com/security/CVE-2016-1000104
marc.info?l=oss-security&m=146885145004975&w=2
apache.org/security/asf-httpoxy-response.txt
cve.org/CVERecord?id=CVE-2016-1000104