Skip to main content

Debug mode

Description​

When Debug mode is left turned on by developers, it allows attackers to gather precious information from excessive error reporting messages such as entire stack traces or tracebacks.

Remediation​

Disabled Debug mode.

Configuration​

CheckId: information_disclosure/debug_mode

Examples​

Ignoring this check​

{
    "checks": {
        "information_disclosure/debug_mode": {
            "skip": true
        }
    }
}

Score​

  • Escape Severity: MEDIUM
  • OWASP: A07:2023
  • PCI DSS: 6.5.5
  • CWE
    • 200
    • 215
    • 489
    • 668
    • 1258
    • 1295
  • WASC: 14

CVSS​

  • CVSS_VECTOR: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:H/RL:O/RC:C
  • CVSS_SCORE: 5.1

References​

https://www.infosecmatter.com/bug-bounty-tips-8-oct-14/#4-graphql-notes-for-beginners