Misconfiguration: Missing Custom Error Page (CWE-12 & CWE-756)
P
PortSwigger Web Security
Submitted None
Actions:
Reported by
wala3at
Vulnerability Details
Technical details and impact analysis
Hi
I found that custom errors for ```` http://portswigger.net ```` application framework `are not configured.,
so application vulnerable to CWE-756 & CWE-12
https://cwe.mitre.org/data/definitions/12.html
https://cwe.mitre.org/data/definitions/756.html
- Impact:
Default error pages gives detailed information about the error that occurred, and should not be used in production environments.
Attackers can leverage the additional information provided by a default error page to mount attacks targeted on the framework, database, or other resources used by the application.
- POC:
```` http://portswigger.net/%5c.../file ````
{F185140}
thanks
Report Details
Additional information and metadata
State
Closed
Substate
Informative