Summary
The server disclosed the version of a server side technology it is running via an HTTP response header, and that version is affected by known vulnerabilities. The version, header and vulnerabilities, listed by severity, are given in the other info. See the references for the details of each. Note that some distributions backport security fixes without changing the version number, so check whether the fixes have actually been applied before reporting these as confirmed.
Solution
Upgrade PHP to a supported version which includes fixes for the listed vulnerabilities. Also configure the server not to disclose the PHP version, e.g. by setting "expose_php = Off" in php.ini and suppressing version details in the "Server" header.Other Info
The server disclosed that it is running PHP version 8.1.2 via the "X-Powered-By" HTTP response header. 1 known vulnerabilities: 0 critical, 1 high, 0 medium, 0 low. High: CVE-2024-4577References
- https://www.php.net/supported-versions.php
- https://github.com/php/php-src/security/advisories
- https://www.zaproxy.org/docs/desktop/addons/passive-scan-rules/php-known-vulnerabilities/#cve-2024-4577