Seems to be a false positive. You can set the score when the IDS reports issues in /usr/local/ispconfig/security/securiry_settings.ini