The URL-path name must be set to the file path name or the directory path name.

The ScriptAlias directive controls which directories the Apache server "sees" as containing scripts. If the directive uses a URL-path name that is different than the actual file system path, the potential exists to expose the script source code.

Enter the following command:

grep "ScriptAlias" /usr/local/apache2/conf/httpd.conf.

If any enabled ScriptAlias directive do not have matching URL-path and file-path or directory-path entries, this is a finding.

Edit the httpd.conf file and set the ScriptAlias URL-path and file-path or directory-path entries.