STIGQter: STIG Summary: MongoDB Enterprise Advanced 3.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 24 Jul 2020:

MongoDB must provide non-privileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

DISA Rule

SV-96607r1_rule

Vulnerability Number

V-81893

Group Title

SRG-APP-000266-DB-000162

Rule Version

MD3X-00-000520

Severity

CAT II

CCI(s)

• CCI-001312 - The information system generates error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

Weight

10

Fix Recommendation

Configure custom database code and associated application code not to divulge sensitive information or information useful for system identification in error messages.

Check Contents

Check custom database code to verify that error messages do not contain information beyond what is needed for troubleshooting the issue.

If custom database errors contain PII data, sensitive business data, or information useful for identifying the host system or database structure, this is a finding.

When attempting to login with incorrect credentials, the user will receive an error message that the operation was unauthorized.

If a user is attempting to perform an operation for which they do not have privileges, the database will return an error message that the operation is not authorized.

Vulnerability Number

V-81893

Documentable

False

Rule Version

MD3X-00-000520

Severity Override Guidance

Check custom database code to verify that error messages do not contain information beyond what is needed for troubleshooting the issue.

If custom database errors contain PII data, sensitive business data, or information useful for identifying the host system or database structure, this is a finding.

When attempting to login with incorrect credentials, the user will receive an error message that the operation was unauthorized.

If a user is attempting to perform an operation for which they do not have privileges, the database will return an error message that the operation is not authorized.

Check Content Reference

M

Target Key

3265

Comments