Information
To include the language used and aim of the program, and that documentation is provided to the IAO.
Vulnerability Key: V0013614
IA Controls: ECSD-1 Software Development Change Controls
Categories: 12.9 Documentation
Severity: Category III
Ref: WEB SERVER SECURITY TECHNICAL IMPLEMENTATION GUIDE Section 4.2
CGI is a standard for interfacing external applications with information servers, such as HTTP or web
servers. The definition of CGI as web-based applications is not to be confused with the more
specific .cgi file extension. CGI applications can be written in most programming languages. Common
applications involve acquiring data via a web page and the browser, executing the CGI application, and
returning customized web content. There is a possibility of compromising security when using CGI.
CGI programs that are carelessly written can grant the malicious user as much access to the server as
a privileged account. Documenting these programs will allow the site to maintain an inventory of the
interactive programs so that rogue programs are not installed and run from the web server.
NOTE: Nessus did not perform this check as it requires manual verification with the Web Manager that all interactive (CGI)
programs are documented and provided to the IAO.