CVE-1999-0678

Apache HTTP Server - Unauthenticated Arbitrary File Read via Default ServerRoot Configuration

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-1999-0678. PoCs published by anonymous, lto7777777.

AI-analyzed exploit summary This is a writeup describing a misconfiguration in Debian GNU/Linux 2.1's Apache package where the /usr/doc directory is exposed via an alias, allowing remote users to browse documentation and potentially identify vulnerable software.

Description

A default configuration of Apache on Debian GNU/Linux sets the ServerRoot to /usr/doc, which allows remote users to read documentation files for the entire server.

Exploits (2)

exploitdb WRITEUP VERIFIED
by anonymous · textremotelinux
https://www.exploit-db.com/exploits/19253

This is a writeup describing a misconfiguration in Debian GNU/Linux 2.1's Apache package where the /usr/doc directory is exposed via an alias, allowing remote users to browse documentation and potentially identify vulnerable software.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Debian GNU/Linux 2.1 apache package, Boa
No auth needed
Prerequisites: Target running Debian GNU/Linux 2.1 with default Apache or Boa configuration
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP
by lto7777777 · poc
https://github.com/lto7777777/CVE-1999-0678

This repository provides a detailed technical walkthrough of exploiting, detecting, and remediating CVE-1999-0678, a directory traversal vulnerability in Apache. It includes steps for vulnerability scanning, manual verification, IDS deployment (Snort), and mitigation strategies.

Classification
Writeup 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Apache Web Server (legacy versions)
No auth needed
Prerequisites: Vulnerable Apache configuration with exposed directories · Network access to the target server
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (1)

Core 1
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/318

Scores

EPSS 0.3141
EPSS Percentile 98.1%

Details

Status published
Products (1)
apache/http_server
Published Jan 17, 1999
Tracked Since Feb 18, 2026