CVE-2001-0925
The default installation of Apache before 1.3.19 allows remote attackers to list directories...
The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.
Exploit likelihood
What each source reports
NVD Score used
The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.
- Record
CVE-2001-0925- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.
- Record
CVE-2001-0925- Updated
- 2026-11-02
EUVDEUVD-2001-0908 No score
The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.
- Record
EUVD-2001-0908- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qr8r-5469-gp63 No score
The default installation of Apache before 1.3.19 allows remote attackers to list directories...
The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.
- Record
GHSA-qr8r-5469-gp63- Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache 1.3 - Artificially Long Slash Path Directory Listing (1) | 2001-06-13 |
| Exploit-DB | Apache 1.3 - Artificially Long Slash Path Directory Listing (2) | 2002-02-21 |
| Exploit-DB | Apache 1.3 - Artificially Long Slash Path Directory Listing (3) | 2001-06-13 |
| Exploit-DB | Apache 1.3 - Artificially Long Slash Path Directory Listing (4) | 2001-06-13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2001-0925 is a medium vulnerability (CVSS 5.0) in Apache Http Server, published March 12, 2001. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 75.2%, the 99th percentile. No source names a fixed version.
References
securityfocus.com/archive/1/193081
apacheweek.com/features/security-13
linuxsecurity.com/advisories/other_advisory-1452.html
exchange.xforce.ibmcloud.com/vulnerabilities/6921
Show 14 moreShow less
debian.org/security/2001/dsa-067
linux-mandrake.com/en/security/2001/MDKSA-2001-077.php3
lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2001-0925
github.com/advisories/GHSA-qr8r-5469-gp63