Version Disclosure (ASP.NET)

Description

The HTTP responses returned by this web application include an header named X-AspNet-Version or response body contains version information. The value of this header is used by Visual Studio to determine which version of ASP.NET is in use. It is not necessary for production sites and should be disabled.

Remediation

Apply the following changes to the web.config file to prevent ASP.NET version disclosure:

<System.Web>
 <httpRuntime enableVersionHeader="false" />
</System.Web>

References

Related Vulnerabilities

Severity

Classification

Tags