11
Nature Type ID Name Page
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1349 OWASP Top Ten 2021 Category A05:2021 - Security
Misconfiguration
1344 2493
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms ASP.NET Misconfiguration: Creating
Debug Binary
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE-12: ASP.NET Misconfiguration: Missing Custom Error Page
Weakness ID : 12
Structure : Simple
Abstraction : Variant
Description
An ASP .NET application must enable custom error pages in order to prevent attackers from mining
information from the framework's built-in responses.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 756 Missing Custom Error Page 1579
Applicable Platforms
Language : ASP.NET (Prevalence = Undetermined)
Background Details
The mode attribute of the <customErrors> tag defines whether custom or default error pages are
used.
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Default error pages gives detailed information about the
error that occurred, and should not be used in production
environments. Attackers can leverage the additional
information provided by a default error page to mount
attacks targeted on the framework, database, or other
resources used by the application.
CWE Version 4.14
CWE-12: ASP.NET Misconfiguration: Missing Custom Error Page
CWE-12: ASP.NET Misconfiguration: Missing Custom Error Page