ASP.NET application-level tracing enabled

Description

Application-level tracing enables trace log output for every page within an application. When the <trace> element is enabled for remote users (localOnly="false"), any user can view an detailed list of recent requests to the application simply by browsing to the page trace.axd.

Remediation

Check the <strong>&lt;trace&gt;</strong> element from web.config and ensure that enabled attribute is set to <strong>&quot;False&quot;</strong> and/or localOnly attribute is set to <strong>&quot;true&quot;</strong>. <br/><br/> Example: &lt;trace enabled=&quot;False&quot; localOnly=&quot;True&quot;&gt;

References

Related Vulnerabilities