CVE-2001-0925: Path Traversal
Published Mar 12, 2001
·Updated
The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) modnegotiation, (2) moddir, or (3) modautoindex.
Affected Software
5 affected components
Apache HTTP Server=1.3.11
Apache HTTP Server=1.3.12
Apache HTTP Server=1.3.14
Apache HTTP Server=1.3.17
Debian Debian Linux=2.2
Remediation
Patch Available
Event History
Mar 12, 2001
CVE Published
05:00 AM
Feb 2, 2002
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2001-0925?
CVE-2001-0925 has a medium severity rating as it allows directory listing, which can expose sensitive information.
2
How do I fix CVE-2001-0925?
To fix CVE-2001-0925, upgrade the Apache HTTP Server to version 1.3.19 or later.
3
What versions of Apache are affected by CVE-2001-0925?
CVE-2001-0925 affects Apache HTTP Server versions 1.3.11 through 1.3.17.
4
Can CVE-2001-0925 be exploited remotely?
Yes, CVE-2001-0925 can be exploited remotely by attackers to list directories.
5
What modules are involved in CVE-2001-0925?
CVE-2001-0925 involves the mod_negotiation, mod_dir, and mod_autoindex modules of Apache.