{"id":"CVE-2001-0925","aliases":["EUVD-2001-0908","GHSA-qr8r-5469-gp63"],"status":"published","title":"The default installation of Apache before 1.3.19 allows remote attackers to list directories...","description":"The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.75238,"percentile":0.99515,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2001-03-12T05:00:00Z","modified":"2026-06-16T21:55:14Z","exploits":[{"source":"exploitdb","id":"EDB-20692","title":"Apache 1.3 - Artificially Long Slash Path Directory Listing (1)","type":"remote","platform":"multiple","date":"2001-06-13","verified":true,"url":"https://www.exploit-db.com/exploits/20692"},{"source":"exploitdb","id":"EDB-20693","title":"Apache 1.3 - Artificially Long Slash Path Directory Listing (2)","type":"remote","platform":"multiple","date":"2002-02-21","verified":true,"url":"https://www.exploit-db.com/exploits/20693"},{"source":"exploitdb","id":"EDB-20694","title":"Apache 1.3 - Artificially Long Slash Path Directory Listing (3)","type":"remote","platform":"multiple","date":"2001-06-13","verified":true,"url":"https://www.exploit-db.com/exploits/20694"},{"source":"exploitdb","id":"EDB-20695","title":"Apache 1.3 - Artificially Long Slash Path Directory Listing (4)","type":"remote","platform":"multiple","date":"2001-06-13","verified":true,"url":"https://www.exploit-db.com/exploits/20695"}],"products":[{"vendor":"apache","product":"http_server"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"http://www.securityfocus.com/archive/1/193081","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.apacheweek.com/features/security-13","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/archive/1/178066","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.linuxsecurity.com/advisories/other_advisory-1452.html","tags":["vendor-advisory","x_refsource_ENGARDE","x_transferred","Third Party Advisory"]},{"url":"http://www.securityfocus.com/cgi-bin/archive.pl?id=1\u0026start=2002-01-27\u0026end=2002-02-02\u0026mid=199857\u0026threads=1","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/6921","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/archive/1/168497","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.debian.org/security/2001/dsa-067","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory"]},{"url":"http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-077.php3","tags":["vendor-advisory","x_refsource_MANDRAKE","x_transferred","Broken Link"]},{"url":"http://www.securityfocus.com/bid/2503","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit","Patch","Third Party Advisory","VDB Entry"]},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2001-0925"},{"url":"https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-qr8r-5469-gp63"}],"sources":{"cve":[{"id":"CVE-2001-0925","description":"The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.","status":"published","published":"2002-02-02T05:00:00Z","modified":"2024-08-08T04:37:07.135Z","updated_at":"2026-11-02T14:34:43.032065Z"}],"euvd":[{"id":"EUVD-2001-0908","description":"The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.","status":"published","published":"2002-02-02T05:00:00Z","modified":"2024-08-08T04:37:07Z","updated_at":"2026-11-03T01:14:49.590185Z"}],"ghsa":[{"id":"GHSA-qr8r-5469-gp63","title":"The default installation of Apache before 1.3.19 allows remote attackers to list directories...","description":"The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.","status":"published","published":"2022-04-30T18:17:00Z","modified":"2025-04-03T03:40:21Z","cwes":["CWE-22"],"updated_at":"2026-11-02T15:00:37.520566Z"}],"nvd":[{"id":"CVE-2001-0925","description":"The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.","status":"published","published":"2001-03-12T05:00:00Z","modified":"2026-06-16T21:55:14.357Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:00:39.593487Z"}]}}