Comment on Popular sites with Apache server-status enabled (leaking internal details)Comments−marcuspovey13yYou've got to watch this... Apache typically limits this to localhost, but if you use squid as a reverse proxy (quite common) then you can see this easily being exposed since all requests will appear to come from the local machine.−ludwigvan13ySimilarly, if you are using nginx in front of apache, watch out.−chokma13yAnd Ubuntu server 12.04 seems to enable this by default without access limit - sudo a2dismod status helps to disable it.
Comments
You've got to watch this... Apache typically limits this to localhost, but if you use squid as a reverse proxy (quite common) then you can see this easily being exposed since all requests will appear to come from the local machine.
Similarly, if you are using nginx in front of apache, watch out.
And Ubuntu server 12.04 seems to enable this by default without access limit -
helps to disable it.