CVE-2001-1013: Apache UserDir username enumeration via differing error codes

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityThe flaw only discloses valid usernames and requires UserDir to be enabled, but it is remotely reachable without authentication and has public exploit material and a high EPSS score.

What it is

Apache on Red Hat Linux with the UserDir directive enabled returns different error codes depending on whether a requested username exists but lacks a public_html directory, versus a username that does not exist. This observable difference lets a remote attacker distinguish valid accounts from invalid ones. It matters because confirmed usernames feed credential guessing and targeted attacks, though the flaw only leaks account existence, not credentials or data.

Impact

An attacker gains a list of valid local usernames on the server. That information supports follow-on brute force, password spraying or social engineering, but no direct access or data exposure results from this flaw alone.

Attack surface

Reachable remotely over the network through HTTP requests to user directory URLs when UserDir is enabled; no authentication or user interaction is required per the AV:N/AC:L/Au:N vector. The record does not specify exact request paths or Apache versions.

Exploitation

Not listed in CISA KEV and no ransomware usage documented; EPSS is high (0.65563, 99.2nd percentile), and a reference carries an Exploit tag, indicating public exploit material exists, but the record does not confirm active in-the-wild exploitation.

What to do

• Apply the vendor patch referenced in the SecurityFocus BID 3335 entry, or upgrade Apache to a release that normalizes UserDir error responses.
• If UserDir is not required, disable it; otherwise restrict it to explicitly approved accounts.
• Configure uniform error responses for user directory requests so existing and non-existing usernames are indistinguishable.
• Monitor and rate-limit repeated user directory requests from single sources to blunt enumeration attempts.

Detection

• Alert on high volumes of HTTP requests to /~username style paths from one source, especially sequences of distinct usernames.
• Baseline the HTTP status codes returned for user directory requests and flag deviations that correlate with account existence.
• Correlate enumeration bursts with subsequent authentication failures or password spraying against the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.