AS24-W2-000010 - The Apache web server must limit the number of allowed simultaneous session requests.

CAT|II

CCI|CCI-000054

Rule-ID|SV-214362r960735_rule

STIG-ID|AS24-W2-000010

STIG-Legacy|SV-102573

STIG-Legacy|V-92485

Vuln-ID|V-214362

AS24-W2-000020 - The Apache web server must perform server-side session management.

Rule-ID|SV-214363r960735_rule

STIG-ID|AS24-W2-000020

STIG-Legacy|SV-102575

STIG-Legacy|V-92487

Vuln-ID|V-214363

AS24-W2-000090 - The Apache web server must produce log records containing sufficient information to establish what type of events occurred.

CCI|CCI-000130

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-001487

Rule-ID|SV-214364r962395_rule

STIG-ID|AS24-W2-000090

STIG-Legacy|SV-102583

STIG-Legacy|V-92495

Vuln-ID|V-214364

AS24-W2-000240 - The Apache web server must not perform user management for hosted applications.

CCI|CCI-000381

Rule-ID|SV-214365r960963_rule

STIG-ID|AS24-W2-000240

STIG-Legacy|SV-102591

STIG-Legacy|V-92503

Vuln-ID|V-214365

AS24-W2-000300 - The Apache web server must have resource mappings set to disable the serving of certain file types.

Rule-ID|SV-214366r960963_rule

STIG-ID|AS24-W2-000300

STIG-Legacy|SV-102593

STIG-Legacy|V-92505

Vuln-ID|V-214366

AS24-W2-000310 - The Apache web server must allow the mappings to unused and vulnerable scripts to be removed.

Rule-ID|SV-214367r960963_rule

STIG-ID|AS24-W2-000310

STIG-Legacy|SV-102595

STIG-Legacy|V-92507

Vuln-ID|V-214367

AS24-W2-000350 - Users and scripts running on behalf of users must be contained to the document root or home directory tree of the Apache web server.

Rule-ID|SV-214368r960963_rule

STIG-ID|AS24-W2-000350

STIG-Legacy|SV-102599

STIG-Legacy|V-92511

Vuln-ID|V-214368

AS24-W2-000360 - The Apache web server must be configured to use a specified IP address and port - IP or Port Only

CCI|CCI-000382

Rule-ID|SV-214369r1043177_rule

STIG-ID|AS24-W2-000360

STIG-Legacy|SV-102601

STIG-Legacy|V-92513

Vuln-ID|V-214369

AS24-W2-000360 - The Apache web server must be configured to use a specified IP address and port - Zero IPs Only

AS24-W2-000380 - The Apache web server must perform RFC 5280-compliant certification path validation - SSLVerifyClient

CCI|CCI-000185

Rule-ID|SV-214370r961038_rule

STIG-ID|AS24-W2-000380

STIG-Legacy|SV-102605

STIG-Legacy|V-92517

Vuln-ID|V-214370

AS24-W2-000380 - The Apache web server must perform RFC 5280-compliant certification path validation - SSLVerifyDepth

AS24-W2-000390 - Only authenticated system administrators or the designated PKI Sponsor for the Apache web server must have access to the Apache web servers private key.

CCI|CCI-000186

Rule-ID|SV-214371r961041_rule

STIG-ID|AS24-W2-000390

STIG-Legacy|SV-102607

STIG-Legacy|V-92519

Vuln-ID|V-214371

AS24-W2-000430 - Apache web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.

CCI|CCI-001082

Rule-ID|SV-214372r961095_rule

STIG-ID|AS24-W2-000430

STIG-Legacy|SV-102615

STIG-Legacy|V-92527

Vuln-ID|V-214372

AS24-W2-000440 - Anonymous user access to the Apache web server application directories must be prohibited.

CAT|I

CCI|CCI-001813

Rule-ID|SV-214373r961095_rule

STIG-ID|AS24-W2-000440

STIG-Legacy|SV-102617

STIG-Legacy|V-92529

Vuln-ID|V-214373

AS24-W2-000450 - The Apache web server must separate the hosted applications from hosted Apache web server management functionality.

Rule-ID|SV-214374r961095_rule

STIG-ID|AS24-W2-000450

STIG-Legacy|SV-102619

STIG-Legacy|V-92531

Vuln-ID|V-214374

AS24-W2-000460 - The Apache web server must invalidate session identifiers upon hosted application user logout or other session termination.

CCI|CCI-001185

Rule-ID|SV-214375r1067795_rule

STIG-ID|AS24-W2-000460

STIG-Legacy|SV-102621

STIG-Legacy|V-92533

Vuln-ID|V-214375

AS24-W2-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - Header HttpOnly Secure

CCI|CCI-001664

Rule-ID|SV-214376r1043180_rule

STIG-ID|AS24-W2-000470

STIG-Legacy|SV-102623

STIG-Legacy|V-92535

Vuln-ID|V-214376

AS24-W2-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - Javascript setCookie

AS24-W2-000480 - The Apache web server must accept only system-generated session identifiers.

Rule-ID|SV-214377r1043180_rule

STIG-ID|AS24-W2-000480

STIG-Legacy|SV-102625

STIG-Legacy|V-92537

Vuln-ID|V-214377

AS24-W2-000500 - The Apache web server must generate unique session identifiers that cannot be reliably reproduced.

CCI|CCI-001188

Rule-ID|SV-214378r1043181_rule

STIG-ID|AS24-W2-000500

STIG-Legacy|SV-102627

STIG-Legacy|V-92539

Vuln-ID|V-214378

AS24-W2-000520 - The Apache web server must generate a session ID using as much of the character set as possible to reduce the risk of brute force.

Rule-ID|SV-214379r1043181_rule

STIG-ID|AS24-W2-000520

STIG-Legacy|SV-102631

STIG-Legacy|V-92543

Vuln-ID|V-214379

AS24-W2-000540 - The Apache web server must augment re-creation to a stable and known baseline.

CCI|CCI-001190

Rule-ID|SV-214380r961122_rule

STIG-ID|AS24-W2-000540

STIG-Legacy|SV-102633

STIG-Legacy|V-92545

Vuln-ID|V-214380

AS24-W2-000560 - The Apache web server must be configured to provide clustering - mod_proxy

CCI|CCI-001844

Rule-ID|SV-214381r961122_rule

STIG-ID|AS24-W2-000560

STIG-Legacy|SV-102635

STIG-Legacy|V-92547

Vuln-ID|V-214381

AS24-W2-000560 - The Apache web server must be configured to provide clustering - ProxyPass

AS24-W2-000580 - The Apache web server document directory must be in a separate partition from the Apache web servers system files.

CCI|CCI-001084

Rule-ID|SV-214382r961131_rule

STIG-ID|AS24-W2-000580

STIG-Legacy|SV-102637

STIG-Legacy|V-92549

Vuln-ID|V-214382

AS24-W2-000610 - The Apache web server must display a default hosted application web page, not a directory listing, when a requested web page cannot be found.

CCI|CCI-001312

Rule-ID|SV-214383r961167_rule

STIG-ID|AS24-W2-000610

STIG-Legacy|SV-102641

STIG-Legacy|V-92553

Vuln-ID|V-214383

AS24-W2-000620 - Warning and error messages displayed to clients must be modified to minimize the identity of the Apache web server, patches, loaded modules, and directory paths.

Rule-ID|SV-214384r961167_rule

STIG-ID|AS24-W2-000620

STIG-Legacy|SV-102643

STIG-Legacy|V-92555

Vuln-ID|V-214384

AS24-W2-000630 - Debugging and trace information used to diagnose the Apache web server must be disabled.

Rule-ID|SV-214385r961167_rule

STIG-ID|AS24-W2-000630

STIG-Legacy|SV-102645

STIG-Legacy|V-92557

Vuln-ID|V-214385

AS24-W2-000640 - The Apache web server must set an absolute timeout for sessions.

CCI|CCI-002361

Rule-ID|SV-214386r1043182_rule

STIG-ID|AS24-W2-000640

STIG-Legacy|SV-102647

STIG-Legacy|V-92559

Vuln-ID|V-214386

AS24-W2-000650 - The Apache web server must set an inactive timeout for completing the TLS handshake - mod_reqtimeout

Rule-ID|SV-214387r1043182_rule

STIG-ID|AS24-W2-000650

STIG-Legacy|SV-102649

STIG-Legacy|V-92561

Vuln-ID|V-214387

AS24-W2-000650 - The Apache web server must set an inactive timeout for completing the TLS handshake - RequestReadTimeout

AS24-W2-000670 - The Apache web server must restrict inbound connections from nonsecure zones.

CCI|CCI-002314

Rule-ID|SV-214388r961278_rule

STIG-ID|AS24-W2-000670

STIG-Legacy|SV-102653

STIG-Legacy|V-92565

Vuln-ID|V-214388

AS24-W2-000690 - Non-privileged accounts on the hosting system must only access Apache web server security-relevant information and functions through a distinct administrative account.

CCI|CCI-002235

Rule-ID|SV-214389r961353_rule

STIG-ID|AS24-W2-000690

STIG-Legacy|SV-102655

STIG-Legacy|V-92567

Vuln-ID|V-214389

AS24-W2-000780 - The Apache web server must prohibit or restrict the use of nonsecure or unnecessary ports, protocols, modules, and/or services.

CCI|CCI-001762

Rule-ID|SV-214390r961470_rule

STIG-ID|AS24-W2-000780

STIG-Legacy|SV-102661

Detections

Analytics

DISA Apache Server 2.4 Windows Site STIG v2r2

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Jun 9, 2026 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Feb 13, 2026 Miscellaneous Metadata updated.

Detections

Analytics

DISA Apache Server 2.4 Windows Site STIG v2r2 Download File

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

DISA Apache Server 2.4 Windows Site STIG v2r2