I am working on SharePoint Online, and our security team has raised the issue
Observation: The application discloses sensitive information about the application to authenticated and unauthenticated users including the DISCO file and WSDL files
Impact: Any user is able to access the disco file on the web server which discloses the location of WSDL files. WSDL files contain specific and sensitive information about a web service. Using this information an attacker will know precisely how to communicate with the web service and could spot potential weaknesses in the web service. A malicious user could leverage the server information displayed to further compromise the system or network.
when we are entering the URL "https://TENANT.SharePoint.Com/Sites/MySite/_vti_bin/spdisco.aspx" it is exposing the all metadata of asmx sevices url (eg: "https://TENANT.SharePoint.Com/Sites/MySite/_vti_bin/alerts.asmx?wsdl").
Is it possible to hide it for users so user can not able to see this?