Question

A CySA+ analyst reviews a vulnerability scan report for a fleet of Apache HTTP servers. The scanner flags CVE-2021-44790 (mod_lua buffer overflow) as critical on all 40 hosts. During validation, the analyst confirms that mod_lua is not compiled into or loaded on any of these servers. The scanner detected the vulnerability solely by matching the reported Apache version banner. What is the MOST accurate conclusion and appropriate next step?

Accepted Answer

The finding is a false positive caused by version-based (banner) detection; document the validation and suppress the finding for these hosts

Answer

The finding is a true positive because the vulnerable Apache version is confirmed; schedule emergency patching within the SLA

Answer

The finding is a false negative; rerun the scan with credentials to reveal additional missed vulnerabilities

Answer

The finding is an exception that requires a compensating control since the module cannot be removed