And you probably should turn off tokens: Apache/2.2.22 (Debian)

Here is an exploit that works on that Apache version:
https://gist.github.com/bodokaiser/8704250