CVE-2001-0925

The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.

• CWE-22

• http://www.apacheweek.com/features/security-13Vendor Advisory
• http://www.debian.org/security/2001/dsa-067Third Party Advisory
• http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-077.php3Broken Link
• http://www.linuxsecurity.com/advisories/other_advisory-1452.htmlThird Party Advisory
• http://www.securityfocus.com/archive/1/168497Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/178066Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/193081Exploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/2503Exploit, Patch, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/cgi-bin/archive.pl?id=1&start=2002-01-27&end=2002-02-02&mid=199857&threads=1Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6921Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
• http://www.apacheweek.com/features/security-13Vendor Advisory
• http://www.debian.org/security/2001/dsa-067Third Party Advisory
• http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-077.php3Broken Link
• http://www.linuxsecurity.com/advisories/other_advisory-1452.htmlThird Party Advisory
• http://www.securityfocus.com/archive/1/168497Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/178066Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/193081Exploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/2503Exploit, Patch, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/cgi-bin/archive.pl?id=1&start=2002-01-27&end=2002-02-02&mid=199857&threads=1Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6921Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

Published

Mar 12, 2001

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2001-0919Internet Explorer 5.50.4134.0100 on Windows ME with "Prompt …
• CVE-2001-0920Format string vulnerability in auto nice daemon (AND) 1.0.4 …
• CVE-2001-0921Netscape 4.79 and earlier for MacOS allows an attacker with …
• CVE-2001-0922ndcgi.exe in Netdynamics 4.x through 5.x, and possibly earli…
• CVE-2001-0923RPM Package Manager 4.0.x through 4.0.2.x allows an attacker…
• CVE-2001-0924Directory traversal vulnerability in ifx CGI program in Info…
• CVE-2001-0926SSIFilter in Allaire JRun 3.1, 3.0 and 2.3.3 allows remote a…
• CVE-2001-0927Format string vulnerability in the permitted function of GNO…
• CVE-2001-0928Buffer overflow in the permitted function of GNOME gtop daem…
• CVE-2001-0929Cisco IOS Firewall Feature set, aka Context Based Access Con…
• CVE-2001-0930Sendpage.pl allows remote attackers to execute arbitrary com…
• CVE-2001-0931Directory traversal vulnerability in Cooolsoft PowerFTP Serv…