STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

The API must not disclose sensitive data in error messages.

DISA Rule

SV-274615r1143648_rule

Vulnerability Number

V-274615

Group Title

SRG-APP-000266

Rule Version

SRG-APP-000266-API-000535

Severity

CAT II

CCI(s)

• CCI-001312 - Generates error messages that provide information necessary for corrective actions without revealing information that could be exploited.

Weight

10

Fix Recommendation

Build or configure the API to not send error messages containing system information or sensitive data to users.

Use generic error messages.

Check Contents

Review the API documentation and interview the API administrator for details regarding how the API displays error messages.

Utilize the API as a nonprivileged user and attempt to execute functionality that will generate error messages.

Review the error messages displayed to ensure no sensitive information is provided to end users.

If error messages are designed to provide users with just enough detail to pass along to support staff to aid in troubleshooting date, time, or other generic information, this is not a finding.

If variable names, SQL strings, system path information, or source or program code are displayed in error messages sent to nonprivileged users, this is a finding.

Vulnerability Number

V-274615

Documentable

False

Rule Version

SRG-APP-000266-API-000535

Severity Override Guidance

Review the API documentation and interview the API administrator for details regarding how the API displays error messages.

Utilize the API as a nonprivileged user and attempt to execute functionality that will generate error messages.

Review the error messages displayed to ensure no sensitive information is provided to end users.

If error messages are designed to provide users with just enough detail to pass along to support staff to aid in troubleshooting date, time, or other generic information, this is not a finding.

If variable names, SQL strings, system path information, or source or program code are displayed in error messages sent to nonprivileged users, this is a finding.

Check Content Reference

M

Target Key

5703