[DW-VA1G4] Apache CGI Source Code Viewing Vulnerability
Description
DW-VA1P4 1.0.1.64
TS is reporting another customer scanned a different vulnerability.
My client has a DW-VA1P4 that fails PCIApply vulnerability scans with error: Apache CGI Source Code Viewing Vulnerability on ports 2002, 80 and 9010
Attachments
Child issues
Linked work items
relates to
VMAX-536
[DW-VA1P4xT] Security scan vulnerability found
![Assignee:]()
VMAX-536
[DW-VA1P4xT] Security scan vulnerability found
Done
Activity
Show:
Details
Priority
Highest
Created: 17 December 2024, 16:18
Updated:
21 May 2025, 02:46
dw-vapxx_v1.0.1.65 > lighttpd 버전 1.4.70 으로 업데이트 되었음
Our internal cybersecurity lead confirmed that the web server in use is Lighttpd, not Apache. The current version is 1.4.61, while the latest available version is 1.4.71. Additionally, the reported vulnerability references Apache as the web server, but since the system uses Lighttpd, this may be a false positive. Further verification is needed to confirm.
포커스 연구소에서 문의한 내용 확인 부탁드립니다.
요청하신 이슈가 접속시에 Source Code가 보인다는 이슈로 보이는데,
실제로 저희가 응답한 값이 HTTP/1.1 403 인 것은 접근을 허용하지 않는다는 의미입니다.
그래서 정확한 이슈를 설명 부탁 드립니다.
정확한 수정의 방향을 정해주셔야 할 듯 합니다.
We have a customer waiting for this fix. Can you provide a possible date or timeline?
Can we expect this to be resolved in the upcoming firmware?
I got the following from the customer a screenshot of the information supplied from a public scanner PCIApply.com
PCIApply가 tool인가요? 혹시 tool이라면 저희에게 제공이 가능하신지요
연구소에 VMAX-536 와 함께 확인 요청하였습니다.