// For flags

CVE-2021-35235

ASP.NET Debug Feature Enabled

Severity Score

5.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The ASP.NET debug feature is enabled by default in Kiwi Syslog Server 9.7.2 and previous versions. ASP.NET allows remote debugging of web applications, if configured to do so. Debug mode causes ASP.NET to compile applications with extra information. The information enables a debugger to closely monitor and control the execution of an application. If an attacker could successfully start a remote debugging session, this is likely to disclose sensitive information about the web application and supporting infrastructure that may be valuable in targeting SWI with malicious intent.

La funcionalidad debug de ASP.NET está habilitada por defecto en Kiwi Syslog Server 9.7.2 y versiones anteriores. ASP.NET permite una depuración remota de aplicaciones web, si es configurada para ello. El modo de depuración causa que ASP.NET compile las aplicaciones con información extra. Esta información permite a un depurador supervisar y controlar de cerca la ejecución de una aplicación. Si un atacante puede iniciar con éxito una sesión de depuración remota, es probable que revele información confidencial sobre la aplicación web y la infraestructura de apoyo que puede ser valiosa para apuntar a SWI con intenciones maliciosas

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-06-22 CVE Reserved
  • 2021-10-27 CVE Published
  • 2024-09-17 CVE Updated
  • 2024-10-02 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-11: ASP.NET Misconfiguration: Creating Debug Binary
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Solarwinds
Search vendor "Solarwinds"
 Kiwi Syslog Server
Search vendor "Solarwinds" for product "Kiwi Syslog Server"
 <= 9.7.2
Search vendor "Solarwinds" for product "Kiwi Syslog Server" and version " <= 9.7.2"
-
Affected