STIGhubSTIGhub
STIGsSearchCompareAbout

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • VPAT
  • DISA STIG Library
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to Apache Server 2.4 UNIX Server Security Technical Implementation Guide

V-214245

CAT II (Medium)

The Apache web server must have Web Distributed Authoring (WebDAV) disabled.

Rule ID

SV-214245r960963_rule

STIG

Apache Server 2.4 UNIX Server Security Technical Implementation Guide

Version

V3R2

CCIs

CCI-000381

Discussion

A web server can be installed with functionality that, by its nature, is not secure. WebDAV is an extension to the HTTP protocol that, when developed, was meant to allow users to create, change, and move documents on a server, typically a web server or web share. Allowing this functionality, development, and deployment is much easier for web authors. WebDAV is not widely used and has serious security concerns because it may allow clients to modify unauthorized files on the web server.

Check Content

In a command line, run "httpd -M | sort" to view a list of installed modules.

If any of the following modules are present, this is a finding:

dav_module
dav_fs_module
dav_lock_module

Fix Text

Determine where the "dav" modules are located by running the following command:

grep -rl "dav_module" <'INSTALL PATH'>

Edit the file and comment out the following modules:

dav_module
dav_fs_module
dav_lock_module

Restart Apache: apachectl restart