The URL-path name must be set to the file path name or the directory path name.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-26327 | WA00560 | WA00560 W22 | SV-33185r1_rule | 2018-12-24 | 1 |
| Description |
|---|
| The ScriptAlias directive controls which directories the Apache server "sees" as containing scripts. If the directive uses a URL-path name that is different than the actual file system path, the potential exists to expose the script source code. |
| ℹ️ Check |
|---|
| Locate the Apache httpd.conf file. Open the httpd.conf file with an editor such as Notepad, and search for the following uncommented directive: ScriptAlias If any enabled ScriptAlias directive does not have matching URL-path and file-path/directory-path entries, this is a finding. Example: Not a finding: ScriptAlias /cgi-bin/ “[Drive Letter]:/[directory path]/cgi-bin/ A finding: ScriptAlias /script-cgi-bin/ “[Drive Letter]:/[directory path]/cgi-bin/ |
| ✔️ Fix |
|---|
| Modify the ScriptAlias directive so the URL-path and file-path/directory-path entries match. |