Apache Double Slash GET Request Forced Directory Listing

medium Nessus Plugin ID 11909

Language:

Synopsis

The remote web server is affected by an information disclosure vulnerability.

Description

It is possible to obtain the listing of the content of the remote web server root by sending the request 'GET // HTTP/1.0' This vulnerability usually affects the default Apache configuration which is shipped with Red Hat Linux, although it might affect other Linux distributions or other web server.

An attacker can exploit this flaw to browse the contents of the remote web server and possibly find hidden links.

Solution

Create an index file for each directory instead of default welcome pages.

Plugin Details

Severity: Medium

ID: 11909

File Name: apache2_double_slash.nasl

Version: 1.24

Type: remote

Family: Web Servers

Published: 10/27/2003

Updated: 11/15/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 2.2

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:apache:http_server

Required KB Items: installed_sw/Apache

Exploit Ease: No exploit is required

Vulnerability Publication Date: 10/28/2003

Reference Information

CVE: CVE-2003-1138

BID: 8898

Detections

Analytics