Question

During an internal engagement, your vulnerability scanner flags a Linux web server as vulnerable to a critical Apache HTTP Server remote code execution CVE. The scan is unauthenticated and matched the vulnerability solely on the Server response header showing 'Apache/2.4.29'. Before adding this to the report, what is the BEST way to determine whether this finding is a false positive?

Accepted Answer

Perform a credentialed check of the installed package version and applied distribution backport patches to verify the actual patch level

Answer

Immediately run the public proof-of-concept exploit against the production server to confirm code execution

Answer

Increase the scanner's severity threshold so lower-confidence findings are suppressed in future scans

Answer

Report the finding as confirmed critical because the banner version matches the vulnerable release in the NVD entry