CVE-2001-0925

MediumPublished

The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request...

Published: Feb 2, 2002
Updated: Aug 8, 2024
Assigning CNA: mitre
Evidence observed: Jun 13, 2001

Primary CVSS

5.0/ 10Medium

nvd · CVSS 2.0

AV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS probability estimate

75.2%

High · next 30 days

Percentile: 99.5%
Model date: Oct 13, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.

Sources

Apache 1.3 - Artificially Long Slash Path Directory Listing (1)Exploit
rfp · multiple · Jun 13, 2001
Apache 1.3 - Artificially Long Slash Path Directory Listing (2)Exploit
st0ic · multiple · Feb 21, 2002
Apache 1.3 - Artificially Long Slash Path Directory Listing (3)Exploit
farm9 · multiple · Jun 13, 2001
Apache 1.3 - Artificially Long Slash Path Directory Listing (4)Exploit
farm9 · multiple · Jun 13, 2001

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.