VCST-67-000028 – The Security Token Service must be configured with the appropriate ports – https
Details Web servers provide numerous processes, features, and functionalities that use TCP/IP ports. Some of these processes may be deemed...
- Home
- Security Hardening
- DISA STIG VMware vSphere 6.7 STS Tomcat V1R1
DISA STIG VMware vSphere 6.7 STS Tomcat V1R1
VCST-67-000028 – The Security Token Service must be configured with the appropriate ports – localhost.https
Details Web servers provide numerous processes, features, and functionalities that use TCP/IP ports. Some of these processes may be deemed...VCST-67-000029 – The Security Token Service must disable the shutdown port.
Details An attacker has at least two reasons to stop a web server. The first is to cause a denial...VCST-67-000030 – The Security Token Service must set the secure flag for cookies.
Details The secure flag is an option that can be set by the application server when sending a new cookie...VCST-67-000021 – The Security Token Service must use the ‘setCharacterEncodingFilter’ filter – setCharacterEncodingFilter filter – filter-mapping
Details Invalid user input occurs when a user inserts data or characters into a hosted application’s data entry field and...VCST-67-000022 – The Security Token Service must set the welcome-file node to a default web page.
Details Enumeration techniques, such as URL parameter manipulation, rely on being able to obtain information about the web server’s directory...VCST-67-000023 – The Security Token Service must not show directory listings.
Details Enumeration techniques, such as URL parameter manipulation, rely on being able to obtain information about the web server’s directory...VCST-67-000024 – The Security Token Service must be configured to show error pages with minimal information.
Details Web servers will often display error messages to client users, displaying enough information to aid in the debugging of...VCST-67-000025 – The Security Token Service must not enable support for TRACE requests.
Details ‘Trace’ is a technique for a user to request internal information about Tomcat. This is useful during product development...