In Page Banner Information Leak

ID

in_page_banner_information_leak

Severity

low

Kind

Information Disclosure

CWE

497

Description

The server returned a version banner string in the response content. Such information leaks may allow attackers to further target specific issues impacting the product and version in use.

Rationale

Version banners displayed in response content allow attackers to identify the exact software and version in use, enabling them to search vulnerability databases for known exploits specific to that release. This targeted reconnaissance reduces the attacker’s effort by eliminating trial-and-error approaches and allows them to deploy exploits with high confidence. Publicly disclosed vulnerabilities for specific versions can be weaponized immediately once the version is identified.

Remediation

Configure the server to prevent such information leaks. For example: Under Tomcat this is done via the "server" directive and implementation of custom error pages. Under Apache this is done via the "ServerSignature" and "ServerTokens" directives.