Detections
Analytics
Lighttpd Default Index Page
medium Web App Scanning Plugin ID 112360
Language:
Synopsis
Lighttpd Default Index PageDescription
The remote web server uses the default Lighttpd index page. This page may contain some sensitive data like the server root and installation paths.This could potentially leak useful information about the server installation to a remote, unauthenticated attacker.
Solution
Remove the default index page.See Also
http://redmine.lighttpd.net/projects/lighttpd/wiki/TutorialConfiguration
Plugin Details
Severity: Medium
ID: 112360
Type: remote
Family: Component Vulnerability
Published: 10/15/2018
Updated: 9/7/2021
Scan Template: api, basic, full, pci, scan
Risk Information
VPR
Risk Factor: Low
Score: 2.9
CVSS v2
Risk Factor: Medium
Base Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: Tenable
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score Source: Tenable
Vulnerability Information
CPE: cpe:2.3:a:lighttpd:lighttpd:*:*:*:*:*:*:*:*
Reference Information
CWE: 200
OWASP: 2010-A6, 2013-A5, 2013-A9, 2017-A6, 2017-A9, 2021-A1, 2021-A6
WASC: Information Leakage
CAPEC: 116, 13, 169, 22, 224, 285, 287, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 312, 313, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, 329, 330, 472, 497, 508, 573, 574, 575, 576, 577, 59, 60, 616, 643, 646, 651, 79
DISA STIG: APSC-DV-000460, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2)
ISO: 27001-A.14.2.5
NIST: sp800_53-CM-6b, sp800_53-SI-15
OWASP API: 2019-API7, 2023-API8
OWASP ASVS: 4.0.2-14.2.1, 4.0.2-8.3.4