Question

During an internal assessment, your web vulnerability scanner reports "Directory Listing Enabled" as a Medium-severity finding on an intranet Apache server at /uploads/. Before including it in the report, you must determine its real risk to the organization. Which action most effectively validates the finding's actual impact and helps you assign an accurate priority?

Accepted Answer

Browse to /uploads/ manually and enumerate the exposed files to determine whether any contain sensitive or exploitable content

Answer

Immediately mark the finding as a confirmed high-severity data exposure because directory listing always leaks confidential data

Answer

Re-run the same scanner with a more aggressive plugin set to see if the severity rating increases

Answer

Discard the finding as a false positive since directory listing is only an informational misconfiguration with no impact