Details

The STRICT_SERVLET_COMPLIANCE influences Tomcat’s behavior in several subtle ways. See the References below for the complete list. It is recommended that STRICT_SERVLET_COMPLIANCE is set to true.

Solution

Start Tomcat with strict compliance enabled. Add the following to your startup script:
-Dorg.apache.catalina.STRICT_SERVLET_COMPLIANCE=true

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/266

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Unix.

References

• 800-53|CM-6b.

Source

• Tenable.com/audits