The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an

Summary

The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.

Timeline

1. Jun 13, 2001Public exploit on Exploit-DB

   EDB-20692, EDB-20694, EDB-20695, EDB-20693

2. Feb 2, 2002, 5:00 AM UTCCVE published
3. Aug 8, 2024, 4:37 AM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

References 18