40028—ELMAH Information Leak

PUBLISHEDsecurity alertMedium

Active

Metadata

Alert ID:: 40028
Risk:: Medium
Type:: Active
CWE:: CWE-94Improper Control of Generation of Code ('Code Injection')

摘要

The Error Logging Modules and Handlers (ELMAH [elmah.axd]) HTTP Module was found to be available. This module can leak a significant amount of valuable information.

解决方案

Consider whether or not ELMAH is actually required in production, if it isn't then disable it. If it is then ensure access to it requires authentication and authorization. See also: https://elmah.github.io/a/securing-error-log-pages/

参考

browse all alerts