Apache Double Slash GET Request Forced Directory Listing

This script is Copyright (C) 2003-2014 Tenable Network Security, Inc.

Synopsis :

The remote web server is affected by an information disclosure

Description :

It is possible to obtain the listing of the content of the remote web
server root by sending the request 'GET // HTTP/1.0' This
vulnerability usually affects the default Apache configuration which
is shipped with Red Hat Linux, although it might affect other Linux
distributions or other web server.

An attacker can exploit this flaw to browse the contents of the remote
web server and possibly find hidden links.

See also :


Solution :

Create an index file for each directory instead of default welcome

Risk factor :

Medium / CVSS Base Score : 5.0
CVSS Temporal Score : 4.5
Public Exploit Available : true

Family: Web Servers

Nessus Plugin ID: 11909 (apache2_double_slash.nasl)

Bugtraq ID: 8898

CVE ID: CVE-2003-1138

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now