WEB_MISC server_info access

 

Code: p1388

Severity: Warning

 

Description: This event is generated when an attempt is made to access server-info. Using the Apache webserver, this url is generally handled by the mod_info module, which will happily disclose valuable information about your webserver which may aid in their attack.

Impact: Information disclosure.

Corrective: Determine if server-info exists on the victim in question, and if the attacker is allowed to access it. If mod_info is necessary on this server, consider restricting access to it via Apache directives, i.e.: SetHandler server-info Order deny,allow Deny from all Allow from .yourdomain.net