Weakness (CWE)
CWE-12: ASP.NET Misconfiguration: Missing Custom Error Page
An ASP .NET application must enable custom error pages in order to prevent attackers from mining information from the framework's built-in responses.
How to prevent it (3 mitigations)
-
System Configuration
Handle exceptions appropriately in source code. ASP .NET applications should be configured to use custom error pages instead of the framework default page.
-
Architecture and Design
Do not attempt to process an error or attempt to mask it.
-
Implementation
Verify return values are correct and do not supply sensitive information about the system.
Source: MITRE CWE-12
1 result · Clear filters · Feed
-
High 7.5
Directory traversal in mkdocs
The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information. NOTE: the vendor has disputed this as described in https://github.com/mkdocs/mkdocs/issues/2601.] and https://g…