CCE-94586-5| Platform: cpe:/a:apache:apache2.2 | Date: (C)2021-06-15 (M)2023-07-04 |
The web server response header of an HTTP response can contain several fields of information including the requested HTML page. The information included in this response can be web server type and version, operating system and version, and ports associated with the web server. This provides the malicious user valuable information without the use of extensive tools.
Parameter:
[PROD/FULL/Major/Minor/Min/OS]
Technical Mechanism:
Edit the /usr/local/apache2/conf/httpd.conf file and ensure the directive is set to Prod.
| CCSS Severity: | CCSS Metrics: |
| CCSS Score : 5.3 | Attack Vector: NETWORK |
| Exploit Score: 3.9 | Attack Complexity: LOW |
| Impact Score: 1.4 | Privileges Required: NONE |
| Severity: MEDIUM | User Interaction: NONE |
| Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | Scope: UNCHANGED |
| | Confidentiality: LOW |
| | Integrity: NONE |
| | Availability: NONE |
| | |
References: | Resource Id | Reference |
|---|
| SCAP Repo OVAL Definition | oval:org.secpod.oval:def:73544 |
