Question

A security analyst receives a critical alert from a vulnerability scanner indicating that a web server is running an outdated version of Apache with a known remote code execution vulnerability (CVE-2021-41773). The analyst verifies that the server is running Apache 2.4.51, but further investigation reveals that the specific vulnerable module (mod_cgi) has been disabled and the URI path normalization feature has been patched through a vendor-specific security update. What should the analyst's next action be?

Accepted Answer

Document the finding as a false positive and update the vulnerability management system with compensating controls in place

Answer

Immediately initiate incident response procedures and isolate the server from the network to prevent exploitation

Answer

Schedule the server for patching during the next maintenance window and apply the latest Apache version

Answer

Create an exception in the vulnerability scanner to suppress future alerts for this CVE on all Apache servers