Skip to content

Latest commit

 

History

History
42 lines (34 loc) · 1.36 KB

aspnet-debugging-enabled.md

File metadata and controls

42 lines (34 loc) · 1.36 KB
Raw
name severity cvss-score cvss-vector cwe-id cwe-name compliance
ASP.NET debugging enabled
low
5.3
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-489
Active Debug Code
HIPAA ISO 27001 owasp10 pci PCI v4.0
164.306(a), 164.312(a)(1), 164.312(d)
A.5.33, A.5.34, A.8.4, A.8.9, A.8.12, A.8.15
A1, A5
6.5.5
pci4-6.2.4

The ASP.NET debug feature is useful for debugging ASP.NET web applications, and even be used for remote debugging. This feature can reveal sensitive information about the internals of the application, such as code snippets, environment variables, security keys, etc. All of this can be used by an attacker to increase the likelihood of an successful attack.

This debug feature should not be enabled in a production environment.

How to fix

{% tabs aspnet-debugging-enabled %} {% tab aspnet-debugging-enabled generic %} ASP.NET debugging is a feature of the ASP.NET framework, configured in the web.config file. To disable it, you need to edit the web.config file and change the debug flag within your compilation directive to false:

    <configuration>  
        <system.web>  
            <compilation  
                debug="false"  
                ...  
            >  
            ...  
            </compilation>  
        </system.web>  
    </configuration>

{% endtab %}

{% endtabs %}