Skip to content
Log In

HTTPAPI Server version must be removed from the HTTP Response Header information.

An XCCDF Rule

Description

HTTP Response Headers contain information that could enable an attacker to gain access to an information system. Failure to prevent the sending of certain HTTP Response Header information to remote requesters exposes internal configuration information to potential attackers.

ID
SV-241788r1025160_rule
Version
IIST-SV-000210
Severity
Low
References
Updated

Remediation Templates

A Manual Procedure

Navigate to "HKLM\System\CurrentControlSet\Services\HTTP\Parameters".
Create REG_DWORD "DisableServerHeader” and set it to "2".

Note: This can be performed multiple ways; this is an example.