CVE-2001-1013: Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a user...

Security readout for executives and security teams

This CVE describes a username-enumeration weakness in Apache on Red Hat Linux when UserDir is enabled. Different error responses can reveal whether a local username exists. It does not directly grant access, but it can help attackers build targeted password-guessing or social-engineering lists. Exposure is most likely on legacy Red Hat Linux Apache systems that still enable UserDir and expose user directory handling publicly. Systems without UserDir, non-Red Hat deployments, or modern configurations are not evidenced as affected by the supplied sources. Treat this as low urgency unless exposed legacy systems support sensitive accounts or face heavy internet scanning. Prioritize during legacy web-server hardening, especially where username secrecy matters for remote access controls. Mitigation focus: Check current Red Hat and Apache guidance for supported remediation.; Disable UserDir where per-user web directories are not required.; Restrict public access to user directory handling where feasible..

Prepared

Jul 1, 2026, 08:27 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.