Version Disclosure (mod_ssl)
Summary#
Invicti identified that the target web server is disclosing the mod_ssl version in its HTTP response. This information might help an attacker gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of mod_ssl.
Impact#
An attacker might use the disclosed information to harvest specific security vulnerabilities for the version identified.
Remediation#
Configure your web server to prevent information leakage from the
SERVER header of its HTTP response. To apply configuration, first make sure you have headers_module installed.
Add the following line to load the headers module in the httpd.conf
LoadModule headers_module modules/mod_headers.so
After headers_module is loaded, edit or include the following lines of config in the httpd.conf
ServerSignature Off
ServerTokens Prod
<IfModule mod_headers.c>
Header unset Server
</IfModule>
Remedy References#
Classifications#
Invicti Security Insights
Vulnerability Index
You can search and find all vulnerabilities
Select Category
OR
Search Vulnerability
Tags
Related Vulnerabilities
