Détail du CWE-12

An ASP .NET application must enable custom error pages in order to prevent attackers from mining information from the framework's built-in responses.

Informations de base

Modes d'introduction

Implementation
Operation

Plateformes applicables

Langue

Name: ASP.NET (Undetermined)

Conséquences courantes

Mesures d’atténuation potentielles

Phases : System Configuration
Handle exceptions appropriately in source code. ASP .NET applications should be configured to use custom error pages instead of the framework default page.
Phases : Architecture and Design
Do not attempt to process an error or attempt to mask it.
Phases : Implementation
Verify return values are correct and do not supply sensitive information about the system.

Notes de cartographie des vulnérabilités

Justification : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Commentaire : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Références

REF-6

Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors
Katrina Tsipenyuk, Brian Chess, Gary McGraw.
https://samate.nist.gov/SSATTM_Content/papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf

REF-65

19 Deadly Sins of Software Security
M. Howard, D. LeBlanc, J. Viega.

REF-66

ASP.NET Misconfiguration: Missing Custom Error Handling
OWASP, Fortify Software.
https://www.owasp.org/index.php/ASP.NET_Misconfiguration:_Missing_Custom_Error_Handling

Soumission

Modifications