CVE-2003-1418
published 2003-12-31CVE-2003-1418: Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode…
PriorityP418medium4.3CVSS 2.0
AVNACMAuNCPINAN
EPSS
6.58%
93.1th percentile
Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which reveals child process IDs (PID).
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
httpd information disclosure in FileEtag
vendor_redhat·2003-02-25·CVSS 4.3
CVE-2003-1418 [MEDIUM] httpd information disclosure in FileEtag
httpd information disclosure in FileEtag
Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which reveals child process IDs (PID).
Statement: Red Hat does not consider this to be a security issue. The information returned poses no threat to the target machine running httpd.
Package: httpd (Red Hat Enterprise Linux 4) - Will not fix
Package: httpd (Red Hat Enterprise Linux 5) - Will not fix
Package: httpd (Red Hat Enterprise Linux 6) - Will not fix
GHSA
GHSA-w76w-v64m-qrv5: Apache HTTP Server 1
ghsa_unreviewed·2022-04-29
CVE-2003-1418 [MEDIUM] CWE-200 GHSA-w76w-v64m-qrv5: Apache HTTP Server 1
Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which reveals child process IDs (PID).
No detection rules found.
No public exploits indexed.
HackerOne
Confirmed Security Misconfigurations on curl.se (BREACH, Missing Security Headers, ETag Info Disclosure)
hackerone·2025-09-09·CVSS 4.3
[MEDIUM] Confirmed Security Misconfigurations on curl.se (BREACH, Missing Security Headers, ETag Info Disclosure)
Confirmed Security Misconfigurations on curl.se (BREACH, Missing Security Headers, ETag Info Disclosure)
## Summary:
During a security assessment of curl.se, multiple misconfigurations were identified that led to information disclosure or weakened the security posture of the website.
## Affected version:
Website: https://curl.se
Tested on: 09-09-2025
curl version: curl/8.8.0 (x86_64-pc-linux-gnu)
## Steps To Reproduce:
1. Run a scan with Nikto against https://curl.se
2. Observe the following results:
- The server sets "Content-Encoding: deflate" → indicates possible BREACH attack.
- The header "X-Content-Type-Options: nosniff" is missing.
- The server returns ETag values with inode/size/mtime.
## Supporting Material/References:
- BREACH attack: http://breachattack.com/
- Missing Header
Bugzilla
CVE-2003-1418 httpd information disclosure in FileEtag
bugzilla·2011-08-24·CVSS 4.3
CVE-2003-1418 [MEDIUM] CVE-2003-1418 httpd information disclosure in FileEtag
CVE-2003-1418 httpd information disclosure in FileEtag
Apache HTTP Server allows remote attackers to obtain information via (1)
the ETag header, which reveals the inode number, or (2) multipart MIME
boundary, which reveals child proccess IDs (PID).
Discussion:
Statement:
Red Hat does not consider this to be a security issue. The information returned poses no threat to the target machine running httpd.
---
Recent upstream discussion and upstream bug report:
http://thread.gmane.org/gmane.comp.apache.devel/45495
https://issues.apache.org/bugzilla/show_bug.cgi?id=49623
As pointed out there, content of the ETag header can be controlled using the FileETag directive. Its default value is: INode MTime Size
Changing to MTime Size will cause httpd to not use file INode in the ETag headers.
http://www.openbsd.org/errata32.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlhttp://www.securityfocus.com/bid/6939http://www.securityfocus.com/bid/6943https://exchange.xforce.ibmcloud.com/vulnerabilities/11438http://www.openbsd.org/errata32.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlhttp://www.securityfocus.com/bid/6939http://www.securityfocus.com/bid/6943https://exchange.xforce.ibmcloud.com/vulnerabilities/11438
2003-12-31
Published