Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The application must not disclose unnecessary information to users.
Description
Discussion Text
Applications should not disclose information not required for the transaction. (e.g., a web application should not divulge the fact there is a SQL server database and/or its version).
These events usually occur when the web application has not been configured to send specific error messages for error events. Instead, when a processing anomaly occurs, the application displays technical information about the type of application server, database in use, or other technical details.
This provides attackers additional information which they can use to find other attack avenues, or tailor specific attacks, on the application.
These events usually occur when the web application has not been configured to send specific error messages for error events. Instead, when a processing anomaly occurs, the application displays technical information about the type of application server, database in use, or other technical details.
This provides attackers additional information which they can use to find other attack avenues, or tailor specific attacks, on the application.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.