漏洞编号：Configuration File Detected

A configuration file for web applications was detected, containing data about how the web application will act. This file may also include information about module loading, security configuration, session state configuration, and application language and compilation settings and other application specific items such as database connection strings.

QID Detection Logic:
This unauthenticated QID fetches the web.config file and matches for text such as system.webServer, directoryBrowse.

Successful exploitation allows a remote unauthenticated attacker to get configuration information specific to the target that may aid in launching further attacks.

N/A

Workaround:
Customers are advised to prevent public access of the web.config file by applying appropriate security restrictions.