Following are the multiple Vulnerability 's has been reported.
|Vulnerability Name||Severity||Types of Scan|
|SSL Server Supports Weak Encryption Vulnerability||Medium||HDC_PROD|
|SSL Server May Be Forced to Use Weak Encryption Vulnerability||Medium||HDC_PROD|
|SSL Server Allows Anonymous Authentication Vulnerability||Medium||HDC_PROD|
|SSL Server Allows Cleartext Communication Vulnerability||Medium||HDC_PROD|
|SSL/TLS Server supports TLSv1.0||Medium||HDC_PROD|
There are 5 SSL related Vulnerability has been reported.
Release : 10.4
Component : Spectrum Core / SpectroSERVER
1. Enable ModSecurity and rescan the application. If the vulnerabilities are still found then follow the step-2 below:
2. Go to $SPECROOT/tomcat/webapps folder, look for these folders : docs, examples, host-manager, manager, ROOT. Backup these folders and delete them from webapps directory. Rescan and see.
The only impact with deleting the ROOT folder under tomcat/webapps is that the default redirecting to /spectrum will not work. Let me explain you in detail:
Currently when you hit the OC Webserver by just giving the hostname (http://:) it redirects to the /spectrum url (http://:/spectrum) for login page or Administration page. This redirection is being done in index.html file present under ROOT directory. So, if the ROOT directory is removed then this redirection may fail. They can keep the ROOT directory with only index.html and favicon.ico files and rest all can be deleted without any issues.
Note : If these vulnerabilities are found on the CORBA ports(as per expectation), then these have been fixed in 188.8.131.52 with the introduction of Secure CORBA feature.