Security Vulnerabilities Guide

Understanding and fixing common web security vulnerabilities detected by VitaPulse

Medium

Server Software Version Exposed

Your server's 'Server' HTTP header reveals the software name and version (e.g., Apache/2.4.41, nginx/1.18.0).

Risk

Knowing the exact server software and version allows attackers to look up known vulnerabilities (CVEs) specific to that version and craft targeted exploits. For example, a disclosed 'Apache/2.4.49' immediately reveals the critical path traversal vulnerability CVE-2021-41773. This information makes automated scanning attacks much more effective.

Solution

Configure your server to remove or minimize the Server header. Most servers allow you to hide the version number while keeping the software name, or remove the header entirely.

Example

# Nginx
server_tokens off;

# Apache
ServerTokens Prod
ServerSignature Off

OWASP - HTTP Headers

Comments (0)

No messages yet.