cbcvebase.
CVE-2001-0731
published 2001-10-01

CVE-2001-0731: Apache 1.3.20 with Multiviews enabled allows remote attackers to view directory contents and bypass the index page via a URL containing the "M=D" query string.

PriorityP333medium5CVSS 2.0
AVNACLAuNCPINAN
EXPLOIT
EPSS
56.76%
99.0th percentile
Apache 1.3.20 with Multiviews enabled allows remote attackers to view directory contents and bypass the index page via a URL containing the "M=D" query string.

Affected

1 ranges
VendorProductVersion rangeFixed in
apachehttp_server——

Detection & IOCsextracted from sources · hover to see the quote

url/?M=D↗
urlhttp://target-webserver/?M=A↗
urlhttp://target-webserver/?S=D↗
snort
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL WEB_SERVER apache ?M=D directory list attempt"; flow:established,to_server; http.uri; content:"/?M=D"; reference:bugtraq,3009; reference:cve,2001-0731; classtype:web-application-activity; sid:2101519; rev:13; metadata:created_at 2010_09_23, cve CVE_2001_0731, signature_severity Unknown, updated_at 2024_03_08;)
  • →Detect HTTP requests containing query strings used to trigger Apache directory listing: '?M=D', '?M=A', and '?S=D' in the URI, indicating exploitation of the Multiviews content negotiation directory disclosure vulnerability. ↗
  • →Focus detection on inbound HTTP requests to web servers where the URI contains '/?M=D'; the Snort rule (SID 2101519) targets established flows to the server with this exact URI content. ↗
  • ·The vulnerability only affects Apache instances with Multiviews (content negotiation) enabled. Disabling Multiviews mitigates the issue. ↗
  • ·The bypass occurs even when an index.html file is present, meaning the presence of an index page is not a sufficient mitigation. ↗

CVSS provenance

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat5.0MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.