error-handling - IBM AppScan Why does the "Application Error" still appeared where implementation already done?

Question

I am using the IBM app scan and we have found this error shown as "Informational" rather than severity = High. We have implemented codes to countermeasure it but after the second round scan it still there. May I know what is the purpose of all these informational scan results?

Answer 1

AppScan 告诉您它能够在您的应用程序中触发应用程序错误。您的应用程序很可能没有正确检查 AppScan 放入此参数的值。这不一定是安全漏洞，这就是它被列为信息的原因。您可以查看信息问题并可能采取行动。

如果单击该问题，您可以在“问题详细信息”窗格中查看有关它的更多详细信息。那里的信息包括解释问题性质的建议。它还显示完整的 HTTP 请求和响应，包括 AppScan 为触发问题而修改的参数或 cookie 值。您应该查看该信息以了解您的修复程序显然没有解决问题的原因。