Apache httpOnly Cookie Information Disclosure CVE-2012-0053
- by John
A PCI compliance scan, on a CentOS LAMP server fails with this message. The server header and ServerSignature don't expose the Apache version.
Apache httpOnly Cookie Information Disclosure CVE-2012-0053
Can this be resolved by simply specifying a custom ErrorDocument for the 400 Bad Request response? How is the scanner determining this vulnerability, is it invoking a bad request then looking to see if it's the default Apache 400 response?