I have a web site which require user login and password before they can access any materials and use the services. However, a recent VA scan found that one URL link is vulnerable to a an old version of a component. E.g.
The question I want to ask is, how does the scanner knows how to find this vulnerability even though they do not have the login credentials at all? Is it some kind of file/folder configuration problem at the web server side? So should I check the permission of
somelongURLstring.extension ? What about things like robots.txt ? would this file be the cause of scanner being able to find this link?
After poking around for the required string, it was found in a
document.goform.action = '/myservice/somelongURLstring.extension'
and also from a file called
If it's a js file then its considered "publicly downloadable" and that's why the scanner is able to find?