Detections
Analytics
Web Server HTTP Header Internal IP Disclosure
low Nessus Plugin ID 10759
Language:
Synopsis
This web server leaks a private IP address through its HTTP headers.Description
This may expose internal IP addresses that are usually hidden or masked behind a Network Address Translation (NAT) Firewall or proxy server.There is a known issue with Microsoft IIS 4.0 doing this in its default configuration. This may also affect other web servers, web applications, web proxies, load balancers and through a variety of misconfigurations related to redirection.
Solution
Apply configuration suggested by vendor.See Also
http://www.nessus.org/u?fe24f941
Plugin Details
Severity: Low
ID: 10759
File Name: iis_nat.nasl
Version: 1.63
Type: remote
Family: Web Servers
Published: 9/14/2001
Updated: 12/30/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 2.2
CVSS v2
Risk Factor: Low
Base Score: 2.6
Temporal Score: 2
Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2000-0649
CVSS v3
Risk Factor: Low
Base Score: 3.1
Temporal Score: 2.8
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:microsoft:iis
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 7/13/2000
Reference Information
CVE: CVE-2000-0649
BID: 1499
CWE: 200