WSTG-V42-ERRH-01 on ZAP

Application Error Disclosure

Mon, 01 Jan 0001 00:00:00 +0000

This page contains an error/warning message that may disclose sensitive information like the location of the file that produced the unhandled exception. This information can be used to launch further attacks against the web application. The alert could be a false positive if the error message is found inside a documentation page.

Full Path Disclosure

Mon, 01 Jan 0001 00:00:00 +0000

The full path of files which might be sensitive has been exposed to the client.

Information Disclosure - Debug Error Messages

Mon, 01 Jan 0001 00:00:00 +0000

The response appeared to contain common error messages returned by platforms such as ASP.NET, and Web-servers such as IIS and Apache. You can configure the list of common debug messages.

X-Debug-Token Information Leak

Mon, 01 Jan 0001 00:00:00 +0000

The response contained an X-Debug-Token or X-Debug-Token-Link header. This indicates that Symfony’s Profiler may be in use and exposing sensitive data.