1

I found a runtime error on united.com.

Is it worth submitting? The exception doesn't seem to show any identifiable information.

closed as off-topic by Stephane, user45139, Jens Erat, StackzOfZtuff, WhiteWinterWolf Sep 15 '15 at 8:49

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Stephane, Jens Erat, WhiteWinterWolf
If this question can be reworded to fit the rules in the help center, please edit the question.

1

The best practice for web applications is to not reveal any unwanted information to the outside.

A custom error message should be displayed on any errors. You can let the developers know.

However, these would be just informational findings.

  • That unwanted information could lead an attack the useful information he/she requires to compromise your website. Ofcourse, it's very dependant on how well the website is written. – Paul Sep 15 '15 at 7:53
  • It completely depends on how well the website is written. Invest time and with adequate skills one might get more detailed information about the application's architecture and even sensitive data from the back end. – feral_fenrir Sep 15 '15 at 8:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.