CVE-2001-0731: Apache HTTP Server Multiviews directory listing and index bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityThe flaw only exposes directory contents and bypasses the index page, with no integrity or availability impact, but the high EPSS score and unauthenticated network reach warrant prompt attention.

What it is

Apache 1.3.20 with Multiviews enabled allows remote attackers to view directory contents and bypass the index page by sending a URL containing the "M=D" query string. This exposes files that the server's index page would otherwise hide, weakening access control on directory listings.

Impact

An attacker gains read access to directory contents that should have been concealed by the index page, potentially revealing filenames and structure useful for further targeting. No write, code execution or privilege escalation is described.

Attack surface

Reachable over the network via a crafted HTTP request to a Multiviews-enabled Apache 1.3.20 server; no authentication or user interaction is required per the AV:N/AC:L/Au:N vector.

Exploitation

Not listed in CISA KEV and no exploit tag appears in the references, though EPSS is high at 0.56756 (99th percentile), indicating elevated predicted exploitation activity.

What to do

• Upgrade Apache HTTP Server to a version that fixes the Multiviews handling issue, or apply the vendor patch referenced in the ApacheWeek advisory.
• Disable the Multiviews option (Options -MultiViews) on directories where it is not required.
• Ensure directory indexes are disabled (Options -Indexes) so directory contents are not listed even if the index page is bypassed.
• Review and restrict access to directories containing sensitive files using authentication or network controls.

Detection

• Search web server access logs for requests containing the "M=D" query string.
• Monitor for requests that return directory listings or bypass configured index pages on Multiviews-enabled paths.
• Alert on unusual directory enumeration patterns from single source IPs against Apache 1.3.x servers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.