Detailed bug description:
"A web directory was found to be browsable, which means that anyone can see the contents of the directory. These directories can be found:
* via page spidering (following hyperlinks), or
* as part of a parent path (checking each directory along the path and searching for ""Directory Listing"" or similar strings), or
* by brute forcing a list of common directories.
Browsable directories could allow an attacker to perform a directory traversal attack by viewing ""hidden"" files in the web root, including CGI scripts, data files, or backup pages."
Steps to reproduce:
"HTTP request to https://10.226.0.9/icons/
HTTP response code was an expected 200
5: </head> 6: <body> 7: <h1>Index of /icons</h1> 8: <table> 9: ...CO]""></th><th><a href=""?C=N;O=D"">Name</a></th><th><a href=""?C=M;O=A..."
Expected results:
No directory and no items index is provided.
Apache HTTPD
Disable web directory browsing for all directories and subdirectories
In your httpd.conf file, disable the "Indexes" option for the appropriate <Directory> tag by removing it from the Options line.
Fix proposed to branch: 8.0
Change author: Anton Chevychalov <email address hidden>
Review: https:/