We’re rewarding the question askers & reputations are being recalculated! Read more.
2 edited tags
| link
source | link

Implications of Trace/Track Methods on Apache

When performing vulnerability scans using Nessus, against a host running Apache, one expected result is always "HTTP TRACE / TRACK Methods Allowed". While this result only has a base CVSS of 4.3, I always recommend that it be corrected. The fix is easy enough that I have never received push back.

What are the real life implications of leaving something like this open?