People mis-configure Apache all the time. They leave their site wide open for attack. They're vulnerable.
Saying it's not a vulnerability when 3,000 sites all have their source code visible to the world is like having your arm chopped off and saying "no it isn't, it's just a flesh wound."
I know it's not a cool remote root buffer overflow exploit hat trick 540 front side flip, but it's a security hole which people need to be educated about.
Comments
People mis-configure Apache all the time. They leave their site wide open for attack. They're vulnerable.
Saying it's not a vulnerability when 3,000 sites all have their source code visible to the world is like having your arm chopped off and saying "no it isn't, it's just a flesh wound."
I know it's not a cool remote root buffer overflow exploit hat trick 540 front side flip, but it's a security hole which people need to be educated about.
But Apache isn't misconfigured in this instance - a file was uploaded and people are claiming that being able to view that file is a vulnerability.
I guess it is a vulnerability of the same standard as "My password is: password".
I just don't understand why everyone is up-in-arms and so surprised by this "vulnerability." It's common sense...