hshah213217 (Community Member) asked a question.
Veracode Dynamic Analysis reports CWE 757 when it can connect to the machine hosting your application using a weak cryptographic cipher. We recommend reviewing the configuration of your webserver and disabling the weak cipher. May I ask what webserver you are running? IIS on Windows Server?
Thank you,
Boy
IIS on Windows Server is tricky to fix unfortunately, it typically requires adjusting Registry keys, you can read more on it here: https://docs.microsoft.com/en-US/troubleshoot/windows-server/windows-security/restrict-cryptographic-algorithms-protocols-schannel .
I would also recommend searching for your combination of OS + version of IIS (so "Windows Server 2012 IIS 8 disable cipher"). There is a freely available tool at https://www.nartac.com/Products/IISCrypto but I'm not familiar with it and it does not seem to be Open Source so I'm afraid I can't speak to either it's efficacy or security.
Thank you,
Boy Baukema
.png){kind=logo}
Veracode Dynamic Analysis reports CWE 757 when it can connect to the machine hosting your application using a weak cryptographic cipher. We recommend reviewing the configuration of your webserver and disabling the weak cipher. May I ask what webserver you are running? IIS on Windows Server?
Thank you,
Boy