This article will help you to understand the Hosting Security Section of the Perimeter Report.
What is the Hosting Security section?
This section detects vulnerabilities in the Host Systems by scanning the versions of the applications being run. These vulnerabilities have been detected by Bug Hunters or the developers of the systems.
What does the score mean?
These vulnerabilities are organized and scored by the National Vulnerability Database based on how easy they are to exploit, if they have been exploited already, and the damage they could cause if exploited.
Any vulnerability with a Common Vulnerability Score rated higher than 8 should be considered an elevated vulnerability. See our CVSS explainer video
How to remediate these vulnerabilities:
You will need to update the affected Host System application to the most recent stable version. The affected Host System (such as OpenSSH) can be identified in the description of each vulnerability.
I'm using a Hosting Provider, what do I do?
You will need to contact your Hosting Provider to make them aware of the vulnerability and request that they update the affected Host System.
The Host System is up to date or has been updated with back patches, but is still being shown as outdated by the Perimeter Report. What do I do?
If a Host System is updated by back patching, it may have already been updated to remediate the vulnerability without actually updating the visible version of the system. As the vulnerability scan detects the publicly visible version of the Host System, partial updates via backpatches are not visible, which can lead to false positives.
If this is the case, you can reach out to our Customer Support team by emailing contact@upfort.com with all available patch notes/records. We will then manually review the data and update your reports to remove the vulnerabilities if required.