Description
This web application is storing some connection strings in plaintext inside the web.config file. This is not recommended as an attacker might gain access to this file using a path traversal (or similar) vulnerabilities. It's recommended to use Protected Configuration to improve the security of your application by encrypting sensitive information that is stored in the web.config file.
Remediation
ASP.NET provides a feature called Protected Configuration, which enables you to encrypt sensitive information in a configuration file. It's recommended to use this feature to encrypt sensitive information that is stored in the web.config file.
References
Related Vulnerabilities
Adobe Experience Manager Information Disclosure via Apache Sling v2.3.6 vulnerability
WordPress Plugin Swim Team Arbitrary File Download (1.44.1077)
WordPress Plugin WordPress Mobile Pack Information Disclosure (2.0.1)
Spring Boot Misconfiguration: Developer tools enabled on production
Spring Boot Misconfiguration: Actuator endpoint security disabled