CVE-2001-0925 Path traversal in n/a
Remote attackers can list directory contents instead of serving index files by sending requests with excessive slashes, exposing sensitive file structures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2001-0925?
CVE-2001-0925 is a medium-severity path traversal vulnerability in Apache Http Server, published on 2 Feb 2002. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.
Weakness: CWE-22
Which versions are affected by CVE-2001-0925?
It affects 2 products.
Products include Apache Http Server, Debian Debian Linux.
How do I fix CVE-2001-0925?
No fix has been published for CVE-2001-0925 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2001-0925 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2001-0925 exists.
Public exploit code: 4 Exploit-DB entries.
Other vulnerabilities in Apache Http Server
Sources
Also known as GHSA-qr8r-5469-gp63.