Khan Academy: Lighttpd version disclosure / directory listing

ID H1:6371
Type hackerone
Reporter internetwache
Modified 2014-04-12T22:06:49


Hello there,

the website at isn't configured correctly.

It displays the lighttpd version as well the directory contents. You should disable these features in your lighttpd.conf / php.ini.


``` Index of /

Name Last Modified Size Type Parent Directory/ - Directory index.lighttpd.html 2012-Jun-12 02:46:34 3.4K text/html lighttpd/1.4.28 ```

Yours sincerely, Sebastian Neef