Description
This directory normally returns a 403 Forbidden HTTP status code. Acunetix managed to bypass this restriction by spoofing the "X-Forwarded-For" HTTP header and set various internal IP addresses.
Remediation
X-Forwarded-For HTTP header should not be used for any Access Control List (ACL) checks because it can be spoofed by attackers. Use the real IP address for this type of restrictions.