Description
mod_negotiation is an Apache module responsible for selecting the document that best matches the clients capabilities, from one of several available documents. If the client provides an invalid Accept header, the server will respond with a 406 Not Acceptable error containing a pseudo directory listing. This behaviour can help an attacker to learn more about his target, for example, generate a list of base names, generate a list of interesting extensions, look for backup files and so on.
Remediation
Disable the MultiViews directive from Apache's configuration file and restart Apache.
You can disable MultiViews by creating a .htaccess file containing the following line:
Options -Multiviews
References
mod_negotiation: directory listing, filename bruteforcing
Related Vulnerabilities
Spring Boot Misconfiguration: Actuator endpoint security disabled
WordPress Plugin Count per Day Information Disclosure (3.2.5)
Missing object-src in CSP Declaration
WordPress Plugin WP e-Commerce Shop Styling Arbitrary File Download (2.5)
WordPress Plugin WordPress Social Stream Information Disclosure (1.6)