Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The ColdFusion site-wide error handler must be valid.
Description
Discussion Text
The structure and content of error messages need to be carefully considered by the organization and development team. Any application providing too much information in error logs and in administrative messages to the screen risks compromising the data and security of the application and system.
When the site-wide error handler is blank, information can be presented to an attacker that may expose the cause of exceptions. Having this information, the attacker can then begin attacking this error trying to get the server to fail and cause a DoS, expose PII, or gain access to server resources. A custom site-wide error handler should be created and used that discloses the same generic message to the user for all exceptions and the error must be logged so that the error can be investigated.
When the site-wide error handler is blank, information can be presented to an attacker that may expose the cause of exceptions. Having this information, the attacker can then begin attacking this error trying to get the server to fail and cause a DoS, expose PII, or gain access to server resources. A custom site-wide error handler should be created and used that discloses the same generic message to the user for all exceptions and the error must be logged so that the error can be investigated.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.