CVE-2003-0017: Apache HTTP Server

Medium severity, CVSS 5.0. EPSS: 6.4% chance of exploitation in the next 30 days.

Apache 2.0 before 2.0.44 on Windows platforms allows remote attackers to obtain certain files via an HTTP request that ends in certain illegal characters such as ">", which causes a different filename to be processed and served.

Affected products

• Apache HTTP Server: version 2.0.36 only; version 2.0.37 only; version 2.0.38 only; version 2.0.39 only; version 2.0.40 only; version 2.0.41 only; …

Published 2003-02-07. Last modified 2026-06-16.