A URL that embeds an explicit software or application version number in its path, such as /25.3.6/, discloses information that helps attackers fingerprint the exact software version in use and cross-reference it against known CVEs, which is a reconnaissance and information-disclosure risk. Web Application Firewalls such as FortiWeb provide URL rewriting policies specifically to strip or obfuscate such version strings and other sensitive path elements before they reach the client, reducing the attack surface, whereas plain content paths (RSS feed endpoints, product listing pages, or static informational pages) do not expose this kind of sensitive version metadata.
Community Discussion