As security tester, I need to report and justify that a security misconfiguration in a 3rd party application is a risk to us.
Following is the scenario:
1.) There is a 3rd party application which the customers use to submit their applications to us. We receive the data from the 3rd party application and process them further.
2.) In that particular application, upon clicking a hyperlink an error page is being displayed with the following information:
a) Source file path (however it is forbidden when tried to access) b) .Net framework version which is vulnerable ASP.Net Forms Authentication Bypass c) IIS server version (7.5) which has exploits as per my knowledge.
What is the risk of this misconfiguration to us. How to justify it?
Note: This error page appears only after a user is logged in. And this is a public facing application.