I have an application that need to send out email to the email address configured in web.config file. The code snippet is like following:

    protected void SendEmail(string strPDFName)

    {

        using (SmtpClient client = new SmtpClient())

        {

          using (MailMessage message = new MailMessage())

          {

            message.From = new MailAddress(ConfigurationManager.AppSettings["FromEmail"].ToString());

            message.To.Add(new MailAddress(ConfigurationManager.AppSettings["ToEmail"].ToString()));

            message.Subject = "Application";

            message.Body = "This is message body.";

            client.Send(message);

          }

        }

    }

VeraCode scan reports CWE 201 issue on line "client.Send(message);". In the flaw description, VeraCode indicates it is because of the ConfigurationManager.get_AppSettings call. The email "from" address and "to" address are from web.config file. It does not make sense to report it as a flaw.