CVE-2000-0869

published 2000-11-14

CVE-2000-0869: The default configuration of Apache 1.3.12 in SuSE Linux 6.4 enables WebDAV, which allows remote attackers to list arbitrary directories via the PROPFIND HTTP…

Priority P4 34 medium 5 CVSS 2.0

AV N AC L Au N C P I N A N

EXPLOIT

The default configuration of Apache 1.3.12 in SuSE Linux 6.4 enables WebDAV, which allows remote attackers to list arbitrary directories via the PROPFIND HTTP request method.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
apache	http_server	—	—
suse	suse_linux	—	—
suse	suse_linux	—	—
suse	suse_linux	—	—
suse	suse_linux	—	—
suse	suse_linux	—	—
suse	suse_linux	—	—

Detection & IOCs extracted from sources · hover to see the quote

command PROPFIND / HTTP/1.1↗

version Apache/1.3.12 (Unix) (SuSE/Linux) mod_fastcgi/2.2.2 DAV/0.9.14 mod_perl/1.21 PHP/3.0.15↗

• → Detect unauthenticated PROPFIND requests targeting the root path '/' or arbitrary directories — this is the core exploitation method for CVE-2000-0869 to enumerate directory listings via WebDAV. ↗
• → Alert on HTTP 207 Multi-Status responses from Apache servers in response to PROPFIND requests, which indicates successful WebDAV directory enumeration. ↗
• → Monitor for PROPFIND HTTP method usage in web server access logs, especially against root '/' or sensitive paths, as this method is not used in normal browsing and is the attack vector for this CVE. ↗
• → Flag Apache servers advertising 'DAV/0.9.14' in their Server response header, as this identifies the vulnerable WebDAV module version present in the default SuSE 6.4 Apache 1.3.12 installation. ↗

• · WebDAV is enabled by default in the Apache 1.3.12 package shipped with SuSE Linux 6.4, exposing the entire server file structure to PROPFIND enumeration without any authentication requirement. ↗
• · The default configuration of Apache 1.3.12 in SuSE Linux 6.4 enables WebDAV, which allows remote attackers to list arbitrary directories via the PROPFIND HTTP request method. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.