Global.asa backup file found

Description

Kayran has detected a ‘Global.asa’ file in your system.
This file is an optional file in which can be used to specify event scripts and declare objects that have session or application scopes.
Global.asa file is (usually) not accessible, since the web servers restrict access to this file.

Categorized as a ‘Insertion of Sensitive Information into Externally-Accessible File or Directory’ vulnerability (CWE-538).
In this category, products place sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information itself.

This backup file may contain sensitive information such as: database credentials and sensitive source code snippets.

Information Disclosure exists, which could assist attackers in performing attacks against your assets.

Recommendation

Make sure that access to the ‘Global.asa’ file is restricted so that only authorized actors can access it.
Or, remove the file from the system entirely.

References

https://cwe.mitre.org/data/definitions/538.html

< Return to all Vulnerabilities

Explaining API

We’ve talked about API’s Vulnerability in here, but i feel like there’s much more to talk about and explain since this is a big and

Read More »

HAR Files

In this article, I’ll talk and explain about HAR Files, so if you don’t know what they are, or, what do we use them for,

Read More »

Active Directory Hacking

What does Active Directory mean? The Active Directory infrastructure is a critical infrastructure in most organizations, and it forms the backbone of the organization’s computing

Read More »