Invicti detected that Apache server-status
is enabled.
Information disclosed from this page can be used to gain additional information about the target system.
An attacker can gather reconnaissance information about the internals of the target web server, such as:
This type of information can help the attacker gain a greater understanding of the system in use and the other potential avenues of attack available.
We recommend disabling this functionality. Comment out the Location/server-info
section from Apache configuration file httpd.conf
(for Redhat, Centos, Fedora) or apache2.conf
(for Debian, Ubuntu).
You can search and find all vulnerabilities