GHT2-015 --- Outdated and Vulnerable Nginx Web server
4.15 GHT2-015 --- Outdated and Vulnerable Nginx Web server
Vulnerability ID: GHT2-015
Retest status:
Vulnerability type: Outdated Software
Threat level: Low
Description: {#description-14 .title-findingsection}
An outdated Nginx web server was found that revealed its version number in the banner.
Technical description: {#technical-description-14 .title-findingsection}
According to the banner, the server is running Nginx version 1.19.2:
This version is vulnerable to CVE-2021-23017{.link} which is a security issue in the Nginx resolver.
Impact: {#impact-14 .title-findingsection}
- This might allow an attacker who is able to forge UDP packets from the DNS server to cause a 1-byte memory overwrite, resulting in a worker process crash or other problem. Other issues could lead to Denial of Service.
Recommendation: {#recommendation-14 .title-findingsection}
- Upgrade to the latest version.
- Have a good update policy implemented.
- Do not display the server name and especially the version number in the banner.