Apache User Enumeration Vulnerability
SeverityLow
trBu makaleyi Türkçe okuyunALTERNATIVE NAMES
Apache Usedir Vulnerability
SEVERITY
Low
AFFECTED SYSTEMS
RedHat Linux 7.0 and flavors with Apache Web Servers with UserDir directive enabled.
BACKGROUND
When mod_userdir is enabled on Apache servers, an attacker may brute for possible user names on the server. When this directive is enabled, an attacker may request for user names by putting ~username after the domain name and may reveal the local users. This happens when the local users have no public_html directory to list. Apache generates an error different than the error when no such user is present on the server. Even it is helpful for the attacker this vulnerability may not cause harm but can direct the attacker to targeted attacks. Currently, there are no vendor-supplied patches for this vulnerability.
SOLUTION
- Disable mod_userdir if you don’t have to use it.
- Don’t use UserDir directives on your Apache configuration files.
LEGAL
Copyright (c) 2019 – 2026 ONLAYER Bilişim Teknolojileri A.Ş.
Permission is granted for the redistribution of this alert by explicitly linking the page to be referred. It may not be edited in any way without written consent.
Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties concerning this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from the use of, or reliance on, this information.