AS24-W2-000010 - The Apache web server must limit the number of allowed simultaneous session requests.

800-53|AC-10

CAT|II

CCI|CCI-000054

Rule-ID|SV-102573r1_rule

STIG-ID|AS24-W2-000010

Vuln-ID|V-92485

AS24-W2-000020 - The Apache web server must perform server-side session management.

Rule-ID|SV-102575r1_rule

STIG-ID|AS24-W2-000020

Vuln-ID|V-92487

AS24-W2-000090 - The Apache web server must produce log records containing sufficient information to establish what type of events occurred.

800-53|AU-3

800-53|AU-12

800-53|AU-14(1)

CCI|CCI-000130

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-001487

Rule-ID|SV-102583r1_rule

STIG-ID|AS24-W2-000090

Vuln-ID|V-92495

AS24-W2-000240 - The Apache web server must not perform user management for hosted applications.

CCI|CCI-000381

Rule-ID|SV-102591r1_rule

STIG-ID|AS24-W2-000240

Vuln-ID|V-92503

AS24-W2-000300 - The Apache web server must have resource mappings set to disable the serving of certain file types.

800-53|CM-7

Rule-ID|SV-102593r1_rule

STIG-ID|AS24-W2-000300

Vuln-ID|V-92505

AS24-W2-000310 - The Apache web server must allow the mappings to unused and vulnerable scripts to be removed.

Rule-ID|SV-102595r1_rule

STIG-ID|AS24-W2-000310

Vuln-ID|V-92507

AS24-W2-000350 - Users and scripts running on behalf of users must be contained to the document root or home directory tree of the Apache web server.

Rule-ID|SV-102599r2_rule

STIG-ID|AS24-W2-000350

Vuln-ID|V-92511

AS24-W2-000360 - The Apache web server must be configured to use a specified IP address and port - IP or Port Only

800-53|IA-5(2)

CCI|CCI-000382

Rule-ID|SV-102601r1_rule

STIG-ID|AS24-W2-000360

Vuln-ID|V-92513

AS24-W2-000360 - The Apache web server must be configured to use a specified IP address and port - Zero IPs Only

AS24-W2-000380 - The Apache web server must perform RFC 5280-compliant certification path validation - SSLVerifyClient

CCI|CCI-000185

Rule-ID|SV-102605r1_rule

STIG-ID|AS24-W2-000380

Vuln-ID|V-92517

AS24-W2-000380 - The Apache web server must perform RFC 5280-compliant certification path validation - SSLVerifyDepth

AS24-W2-000390 - Only authenticated system administrators or the designated PKI Sponsor for the Apache web server must have access to the Apache web servers private key.

CCI|CCI-000186

Rule-ID|SV-102607r1_rule

STIG-ID|AS24-W2-000390

Vuln-ID|V-92519

AS24-W2-000430 - Apache web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.

CCI|CCI-001082

Rule-ID|SV-102615r1_rule

STIG-ID|AS24-W2-000430

Vuln-ID|V-92527

AS24-W2-000440 - Anonymous user access to the Apache web server application directories must be prohibited.

CAT|I

CCI|CCI-001813

Rule-ID|SV-102617r1_rule

STIG-ID|AS24-W2-000440

Vuln-ID|V-92529

AS24-W2-000450 - The Apache web server must separate the hosted applications from hosted Apache web server management functionality.

Rule-ID|SV-102619r1_rule

STIG-ID|AS24-W2-000450

Vuln-ID|V-92531

AS24-W2-000460 - The Apache web server must invalidate session identifiers upon hosted application user logout or other session termination.

800-53|AC-12

800-53|SC-23(1)

CCI|CCI-001185

Rule-ID|SV-102621r1_rule

STIG-ID|AS24-W2-000460

Vuln-ID|V-92533

AS24-W2-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - Header HttpOnly Secure

800-53|SC-23(3)

CCI|CCI-001664

Rule-ID|SV-102623r1_rule

STIG-ID|AS24-W2-000470

Vuln-ID|V-92535

AS24-W2-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - Javascript setCookie

AS24-W2-000480 - The Apache web server must accept only system-generated session identifiers.

Rule-ID|SV-102625r1_rule

STIG-ID|AS24-W2-000480

Vuln-ID|V-92537

AS24-W2-000500 - The Apache web server must generate unique session identifiers that cannot be reliably reproduced.

CCI|CCI-001188

Rule-ID|SV-102627r1_rule

STIG-ID|AS24-W2-000500

Vuln-ID|V-92539

AS24-W2-000520 - The Apache web server must generate a session ID using as much of the character set as possible to reduce the risk of brute force.

Rule-ID|SV-102631r1_rule

STIG-ID|AS24-W2-000520

Vuln-ID|V-92543

AS24-W2-000540 - The Apache web server must augment re-creation to a stable and known baseline.

CCI|CCI-001190

Rule-ID|SV-102633r1_rule

STIG-ID|AS24-W2-000540

Vuln-ID|V-92545

AS24-W2-000560 - The Apache web server must be configured to provide clustering - mod_proxy

CCI|CCI-001844

Rule-ID|SV-102635r1_rule

STIG-ID|AS24-W2-000560

Vuln-ID|V-92547

AS24-W2-000560 - The Apache web server must be configured to provide clustering - ProxyPass

800-53|AU-3(2)

AS24-W2-000580 - The Apache web server document directory must be in a separate partition from the Apache web servers system files.

CCI|CCI-001084

Rule-ID|SV-102637r1_rule

STIG-ID|AS24-W2-000580

Vuln-ID|V-92549

AS24-W2-000610 - The Apache web server must display a default hosted application web page, not a directory listing, when a requested web page cannot be found.

CCI|CCI-001312

Rule-ID|SV-102641r1_rule

STIG-ID|AS24-W2-000610

Vuln-ID|V-92553

AS24-W2-000620 - Warning and error messages displayed to clients must be modified to minimize the identity of the Apache web server, patches, loaded modules, and directory paths.

800-53|SI-11

Rule-ID|SV-102643r1_rule

STIG-ID|AS24-W2-000620

Vuln-ID|V-92555

AS24-W2-000630 - Debugging and trace information used to diagnose the Apache web server must be disabled.

Rule-ID|SV-102645r1_rule

STIG-ID|AS24-W2-000630

Vuln-ID|V-92557

AS24-W2-000640 - The Apache web server must set an absolute timeout for sessions.

CCI|CCI-002361

Rule-ID|SV-102647r1_rule

STIG-ID|AS24-W2-000640

Vuln-ID|V-92559

AS24-W2-000650 - The Apache web server must set an inactive timeout for completing the TLS handshake - mod_reqtimeout

Rule-ID|SV-102649r3_rule

STIG-ID|AS24-W2-000650

Vuln-ID|V-92561

AS24-W2-000650 - The Apache web server must set an inactive timeout for completing the TLS handshake - RequestReadTimeout

AS24-W2-000670 - The Apache web server must restrict inbound connections from nonsecure zones.

800-53|AC-17(1)

CCI|CCI-002314

Rule-ID|SV-102653r1_rule

STIG-ID|AS24-W2-000670

Vuln-ID|V-92565

AS24-W2-000690 - Non-privileged accounts on the hosting system must only access Apache web server security-relevant information and functions through a distinct administrative account.

CCI|CCI-002235

Rule-ID|SV-102655r1_rule

STIG-ID|AS24-W2-000690

Vuln-ID|V-92567

AS24-W2-000780 - The Apache web server must prohibit or restrict the use of nonsecure or unnecessary ports, protocols, modules, and/or services.

800-53|CM-6

CCI|CCI-001762

Rule-ID|SV-102661r1_rule

STIG-ID|AS24-W2-000780

Vuln-ID|V-92573

AS24-W2-000800 - The Apache web server must only accept client certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs).

800-53|SC-23(5)

CCI|CCI-002470

Rule-ID|SV-102663r1_rule

STIG-ID|AS24-W2-000800

Vuln-ID|V-92575

AS24-W2-000830 - The Apache web server must be tuned to handle the operational requirements of the hosted application.

800-53|SC-5

CCI|CCI-001094

CCI|CCI-002385

Rule-ID|SV-102667r1_rule

STIG-ID|AS24-W2-000830

Vuln-ID|V-92579

AS24-W2-000860 - The Apache web server cookies, such as session cookies, sent to the client using SSL/TLS must not be compressed.

800-53|SC-8

CCI|CCI-002418

Rule-ID|SV-102673r1_rule

STIG-ID|AS24-W2-000860

Vuln-ID|V-92585

AS24-W2-000870 - Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data - mod_session_crypto

Rule-ID|SV-102943r1_rule

STIG-ID|AS24-W2-000870

Vuln-ID|V-92855

AS24-W2-000870 - Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data - Session On

AS24-W2-000870 - Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data - SessionCookieName

AS24-W2-000870 - Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data - SessionCryptoPassphrase

AS24-W2-000880 - Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to force the encryption of cookies - mod_session_crypto

Rule-ID|SV-102675r1_rule

STIG-ID|AS24-W2-000880

Vuln-ID|V-92587

AS24-W2-000880 - Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to force the encryption of cookies - Session On

AS24-W2-000880 - Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to force the encryption of cookies - SessionCookieName

AS24-W2-000880 - Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to force the encryption of cookies - SessionCryptoPassphrase

AS24-W2-000890 - An Apache web server must maintain the confidentiality of controlled information during transmission through the use of an approved TLS version - SSLEngine

Detections

Analytics

Revision 1.1

Nov 22, 2020

Miscellaneous

Added

Removed