CAS-005 · Question #113
A security architect discovers the following page while testing a website for vulnerabilities: 404 - page not found: /gy67162 The page you have requested is no. avai.able on .his server. Apache…
The correct answer is D. The information can be used for more targeted attacks. The information disclosed in the error message (e.g., "Apache Tomcat 7.0.52") provides attackers insights into the software version, which may have known vulnerabilities. Correcting this issue ensures that attackers cannot use the disclosed information to tailor more…
Question
A security architect discovers the following page while testing a website for vulnerabilities:
404 - page not found: /gy67162 The page you have requested is no. avai.able on .his server. Apache Tomcat 7.0.52 Which of the following best describes why this issue should be corrected?
Options
- AThe website is generating a server error.
- BThe URL for this page can be used for directory traversal.
- CThe website fuzzing tool has overloaded the server's capacity.
- DThe information can be used for more targeted attacks.
How the community answered
(23 responses)- A4% (1)
- B13% (3)
- C4% (1)
- D78% (18)
Explanation
The information disclosed in the error message (e.g., "Apache Tomcat 7.0.52") provides attackers insights into the software version, which may have known vulnerabilities. Correcting this issue ensures that attackers cannot use the disclosed information to tailor more sophisticated or targeted attacks. Best practices include suppressing unnecessary error details to mitigate the risk of information
Community Discussion
No community discussion yet for this question.