Which vulnerability is described by PCI DSS Requirement 6.5.5?

Which vulnerability is described by PCI DSS Requirement 6.5.5?

• A. Cross-site scripting
• B. Insecure direct object references
• C. Improper error handling
• D. Buffer overflows

Answer: (C)

PCI DSS 6.5.5 centers on how an application handles errors and what information about the system is exposed in error messages. When an app returns detailed error messages or stack traces to users or external parties, it can reveal sensitive internals such as database structures, file paths, or authentication details. That kind of information leakage can give attackers useful clues to exploit the system. Improper error handling is exactly about preventing this exposure: keep user-facing errors generic, avoid leaking internal details, and log full, sensitive error information securely for developers to diagnose issues. The other vulnerabilities describe different issues—cross-site scripting involves injecting scripts, insecure direct object references involve access to internal objects, and buffer overflows involve memory safety—so they don’t match what this requirement targets.

PCI DSS 6.5.5 centers on how an application handles errors and what information about the system is exposed in error messages. When an app returns detailed error messages or stack traces to users or external parties, it can reveal sensitive internals such as database structures, file paths, or authentication details. That kind of information leakage can give attackers useful clues to exploit the system. Improper error handling is exactly about preventing this exposure: keep user-facing errors generic, avoid leaking internal details, and log full, sensitive error information securely for developers to diagnose issues. The other vulnerabilities describe different issues—cross-site scripting involves injecting scripts, insecure direct object references involve access to internal objects, and buffer overflows involve memory safety—so they don’t match what this requirement targets.