Test ID:	1.3.6.1.4.1.25623.1.0.107305
Category:	Web application abuses
Title:	Sensitive File Disclosure (HTTP)
Summary:	The script attempts to identify files containing sensitive data; at the remote web server.
Description:	Summary: The script attempts to identify files containing sensitive data at the remote web server. Vulnerability Insight: Currently the script is checking for files like e.g.: - Software (Blog, CMS) configuration or log files - Web / application server configuration / password files (.htaccess, .htpasswd, web.config, web.xml, ...) - Cloud (e.g. AWS) configuration files - Files containing API keys for services / providers - Database backup files - Editor / history files - SSH or SSL/TLS Private Keys - CVE-2017-16894: Laravel framework environment/.env files Vulnerability Impact: Based on the information provided in these files an attacker might be able to gather additional info and/or sensitive data like usernames and passwords. Solution: The sensitive files shouldn't be accessible via a web server. Restrict access to it or remove it completely. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2017-16894 http://packetstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.html http://whiteboyz.xyz/laravel-env-file-vuln.html https://twitter.com/finnwea/status/967709791442341888
Copyright	Copyright (C) 2018 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.