An ASP .NET application must enable custom error pages in order to prevent attackers from mining information from the framework's built-in responses.

Primary

The mode attribute of the <customErrors> tag defines whether custom or default error pages are used.

Implementation

Operation

Confidentiality
Read Application Data
Default error pages gives detailed information about the error that occurred, and should not be used in production environments. Attackers can leverage the additional information provided by a default error page to mount attacks targeted on the framework, database, or other resources used by the application.

System Configuration
Handle exceptions appropriately in source code. ASP .NET applications should be configured to use custom error pages instead of the framework default page.

Architecture and Design
Do not attempt to process an error or attempt to mask it.

Implementation
Verify return values are correct and do not supply sensitive information about the system.

The mode attribute of the <customErrors> tag in the Web.config file defines whether custom or default error pages are used.
In the following insecure ASP.NET application setting, custom error message mode is turned off. An ASP.NET error message with detailed stack trace and platform versions will be returned.

<customErrors mode="Off" />

A more secure setting is to set the custom error message mode for remote users only. No defaultRedirect error page is specified. The local user on the web server will see a detailed stack trace. For remote users, an ASP.NET error message with the server customError configuration setting and the platform version will be returned.

<customErrors mode="RemoteOnly" />

Another secure option is to set the mode attribute of the <customErrors> tag to use a custom page as follows:

<customErrors mode="On" defaultRedirect="YourErrorPage.htm" />

ASP.NET Misconfiguration: Missing Custom Error Handling

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

7 Pernicious Kingdoms
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated References, Demonstrative_Example, Potential_Mitigations, Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Other_Notes, References, Taxonomy_Mappings

CWE Content Team
MITRE
2008-10-14
updated Relationships

CWE Content Team
MITRE
2008-11-24
updated Common_Consequences, Other_Notes, Potential_Mitigations

CWE Content Team
MITRE
2009-03-10
updated Name, Relationships

CWE Content Team
MITRE
2009-07-27
updated Background_Details, Common_Consequences, Other_Notes

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Demonstrative_Examples, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2013-02-21
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Demonstrative_Examples, Potential_Mitigations, References, Relationships

CWE Content Team
MITRE
2020-02-24
updated References, Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated References

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

ASP.NET Misconfiguration: Missing Custom Error Handling