Cis Tomcat7 V110 10.9

---
name: cis-tomcat7-v110-10.9
description: "Do not allow custom header status messages"
category: cis-tomcat
version: "1.1.0"
author: cyberstrike-official
tags: [cis, tomcat, tomcat-7, http-headers, xss, custom-messages]
cis_id: "10.9"
cis_benchmark: "CIS Apache Tomcat 7 Benchmark v1.1.0"
tech_stack: [tomcat, java]
cwe_ids: []
chains_with: []
prerequisites: []
severity_boost: {}
---

# CIS Apache Tomcat 7 Benchmark v1.1.0 - Control 10.9

## Profile Applicability

- Level 2

## Description

Do not allow custom header status messages

**Note**: This is an auto-generated skeleton. Please refer to the CIS Apache Tomcat 7 Benchmark v1.1.0 PDF (pages 9-90) for complete details including:

- Full description and rationale
- Detailed audit procedures with exact commands
- Step-by-step remediation instructions
- Impact analysis
- Default values
- References

## Audit Procedure

Refer to CIS Apache Tomcat 7 Benchmark v1.1.0 - Section 10.9

## Remediation

Refer to CIS Apache Tomcat 7 Benchmark v1.1.0 - Section 10.9

## References

- CIS Apache Tomcat 7 Benchmark v1.1.0
- https://www.cisecurity.org/

## CIS Controls

| CIS Control | Description                 |
| ----------- | --------------------------- |
| Version 7   | Refer to benchmark document |
| Version 8   | Refer to benchmark document |

## Assessment Status

- **Scored**: Scored
- **Profile**: Level 2