CVE-2004-1082: Apache HTTP Server

High severity, CVSS 7.5. EPSS: 7.6% chance of exploitation in the next 30 days.

mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials.

Affected products

• Apache HTTP Server: version 1.3 only; version 1.3.1 only; version 1.3.3 only; version 1.3.4 only; version 1.3.6 only; version 1.3.7 only; …
• Apple Apache Mod Digest Apple: any version
• Avaya Communication Manager: version 1.1 only; version 1.3.1 only; version 2.0 only; version 2.0.1 only
• Avaya Intuity Audix Lx: any version
• Avaya MN100: any version
• Avaya Modular Messaging Message Storage Server: version 1.1 only; version 2.0 only
• Avaya Network Routing: any version
• HP Virtualvault: version 4.5 only; version 4.6 only; version 4.7 only
• HP Webproxy: version a.02.00 only; version a.02.10 only
• IBM HTTP Server: version 1.3.19 only
• OpenBSD OpenBSD: version 3.4 only; version 3.5 only; version current only
• Sco Openserver: version 5.0.6 only; version 5.0.7 only
• Sun Solaris: version 8.0 only; version 9.0 only
• Sun Sunos: version 5.8 only

Published 2004-02-03. Last modified 2026-06-16.