Configurations play a key role in the security of an application. Often, systems and applications will run with a default configuration, pulled from the vendor's manual or from the Internet. This makes guessing passwords, bypassing login pages, and finding well-known setup vulnerabilities a breeze. Another form of insecure configuration management is where a configuration is just plain wrong, either from the start or after changes were made that compromise the security of the application or system. This faulty configuration can then end up getting used everywhere in the company.
Common attacks associated with configuration management vulnerabilities are as follows:
- Server software flaws or misconfigurations ...
