Description
During the scan, Kayran managed to find that the TRACE method is enabled.
The TRACE method is intended to help developers in debugging.
If the TRACE method is enabled, the web server will “echo” the requests using the TRACE method in its responses with the exact request it received.
An attacker can use this information which will assist him/her in conducting further, more advanced attacks against your assets.
Severity/Score
Average Score – 5.3 Medium
Recommendation
Disable the TRACE method to avoid attackers using it, and through that, better exploiting other vulnerabilities.
References
https://owasp.org/www-community/attacks/Cross_Site_Tracing
https://cwe.mitre.org/data/definitions/16
