Apache WebDAV Module PROPFIND Arbitrary Directory Listing

medium Nessus Plugin ID 10505

Synopsis

The remote server is vulnerable to an information disclosure attack.

Description

The WebDAV module can be used to obtain a listing of the remote web server directories even if they have a default page such as index.html.

This allows an attacker to gain valuable information about the directory structure of the remote host and could reveal the presence of files which are not intended to be visible.

Solution

Disable the WebDAV module, or restrict its access to authenticated and trusted clients.

Plugin Details

Severity: Medium

ID: 10505

File Name: webdav.nasl

Version: 1.30

Type: remote

Family: Web Servers

Published: 9/8/2000

Updated: 8/7/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.2

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

Exploit Ease: No exploit is required

Vulnerability Publication Date: 9/7/2000

Reference Information

CVE: CVE-2000-0869

BID: 1656

Detections

Analytics