AS24-W2-000010 - The Apache web server must limit the number of allowed simultaneous session requests.

800-53|AC-10

CAT|II

CCI|CCI-000054

Rule-ID|SV-214362r960735_rule

STIG-ID|AS24-W2-000010

STIG-Legacy|SV-102573

STIG-Legacy|V-92485

Vuln-ID|V-214362

AS24-W2-000020 - The Apache web server must perform server-side session management.

Rule-ID|SV-214363r960735_rule

STIG-ID|AS24-W2-000020

STIG-Legacy|SV-102575

STIG-Legacy|V-92487

Vuln-ID|V-214363

AS24-W2-000090 - The Apache web server must produce log records containing sufficient information to establish what type of events occurred.

800-53|AU-3

CCI|CCI-000130

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-001487

Rule-ID|SV-214364r962395_rule

STIG-ID|AS24-W2-000090

STIG-Legacy|SV-102583

STIG-Legacy|V-92495

Vuln-ID|V-214364

AS24-W2-000240 - The Apache web server must not perform user management for hosted applications.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-214365r960963_rule

STIG-ID|AS24-W2-000240

STIG-Legacy|SV-102591

STIG-Legacy|V-92503

Vuln-ID|V-214365

AS24-W2-000300 - The Apache web server must have resource mappings set to disable the serving of certain file types.

Rule-ID|SV-214366r960963_rule

STIG-ID|AS24-W2-000300

STIG-Legacy|SV-102593

STIG-Legacy|V-92505

Vuln-ID|V-214366

AS24-W2-000310 - The Apache web server must allow the mappings to unused and vulnerable scripts to be removed.

Rule-ID|SV-214367r960963_rule

STIG-ID|AS24-W2-000310

STIG-Legacy|SV-102595

STIG-Legacy|V-92507

Vuln-ID|V-214367

AS24-W2-000350 - Users and scripts running on behalf of users must be contained to the document root or home directory tree of the Apache web server.

Rule-ID|SV-214368r960963_rule

STIG-ID|AS24-W2-000350

STIG-Legacy|SV-102599

STIG-Legacy|V-92511

Vuln-ID|V-214368

AS24-W2-000360 - The Apache web server must be configured to use a specified IP address and port - IP or Port Only

800-53|CM-7b.

CCI|CCI-000382

Rule-ID|SV-214369r1043177_rule

STIG-ID|AS24-W2-000360

STIG-Legacy|SV-102601

STIG-Legacy|V-92513

Vuln-ID|V-214369

AS24-W2-000360 - The Apache web server must be configured to use a specified IP address and port - Zero IPs Only

AS24-W2-000380 - The Apache web server must perform RFC 5280-compliant certification path validation - SSLVerifyClient

800-53|IA-5(2)(a)

CCI|CCI-000185

Rule-ID|SV-214370r961038_rule

STIG-ID|AS24-W2-000380

STIG-Legacy|SV-102605

STIG-Legacy|V-92517

Vuln-ID|V-214370

AS24-W2-000380 - The Apache web server must perform RFC 5280-compliant certification path validation - SSLVerifyDepth

AS24-W2-000390 - Only authenticated system administrators or the designated PKI Sponsor for the Apache web server must have access to the Apache web servers private key.

800-53|IA-5(2)(b)

CCI|CCI-000186

Rule-ID|SV-214371r961041_rule

STIG-ID|AS24-W2-000390

STIG-Legacy|SV-102607

STIG-Legacy|V-92519

Vuln-ID|V-214371

AS24-W2-000430 - Apache web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.

800-53|SC-2

CCI|CCI-001082

Rule-ID|SV-214372r961095_rule

STIG-ID|AS24-W2-000430

STIG-Legacy|SV-102615

STIG-Legacy|V-92527

Vuln-ID|V-214372

AS24-W2-000440 - Anonymous user access to the Apache web server application directories must be prohibited.

800-53|CM-5(1)

CAT|I

CCI|CCI-001813

Rule-ID|SV-214373r961095_rule

STIG-ID|AS24-W2-000440

STIG-Legacy|SV-102617

STIG-Legacy|V-92529

Vuln-ID|V-214373

AS24-W2-000450 - The Apache web server must separate the hosted applications from hosted Apache web server management functionality.

Rule-ID|SV-214374r961095_rule

STIG-ID|AS24-W2-000450

STIG-Legacy|SV-102619

STIG-Legacy|V-92531

Vuln-ID|V-214374

AS24-W2-000460 - The Apache web server must invalidate session identifiers upon hosted application user logout or other session termination.

800-53|SC-23(1)

CCI|CCI-001185

Rule-ID|SV-214375r1067795_rule

STIG-ID|AS24-W2-000460

STIG-Legacy|SV-102621

STIG-Legacy|V-92533

Vuln-ID|V-214375

AS24-W2-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - Header HttpOnly Secure

800-53|SC-23(3)

CCI|CCI-001664

Rule-ID|SV-214376r1043180_rule

STIG-ID|AS24-W2-000470

STIG-Legacy|SV-102623

STIG-Legacy|V-92535

Vuln-ID|V-214376

AS24-W2-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - Javascript setCookie

AS24-W2-000480 - The Apache web server must accept only system-generated session identifiers.

Rule-ID|SV-214377r1043180_rule

STIG-ID|AS24-W2-000480

STIG-Legacy|SV-102625

STIG-Legacy|V-92537

Vuln-ID|V-214377

AS24-W2-000500 - The Apache web server must generate unique session identifiers that cannot be reliably reproduced.

CCI|CCI-001188

Rule-ID|SV-214378r1043181_rule

STIG-ID|AS24-W2-000500

STIG-Legacy|SV-102627

STIG-Legacy|V-92539

Vuln-ID|V-214378

AS24-W2-000520 - The Apache web server must generate a session ID using as much of the character set as possible to reduce the risk of brute force.

Rule-ID|SV-214379r1043181_rule

STIG-ID|AS24-W2-000520

STIG-Legacy|SV-102631

STIG-Legacy|V-92543

Vuln-ID|V-214379

AS24-W2-000540 - The Apache web server must augment re-creation to a stable and known baseline.

800-53|SC-24

CCI|CCI-001190

Rule-ID|SV-214380r961122_rule

STIG-ID|AS24-W2-000540

STIG-Legacy|SV-102633

STIG-Legacy|V-92545

Vuln-ID|V-214380

AS24-W2-000560 - The Apache web server must be configured to provide clustering - mod_proxy

800-53|AU-3(2)

CCI|CCI-001844

Rule-ID|SV-214381r961122_rule

STIG-ID|AS24-W2-000560

STIG-Legacy|SV-102635

STIG-Legacy|V-92547

Vuln-ID|V-214381

AS24-W2-000560 - The Apache web server must be configured to provide clustering - ProxyPass

AS24-W2-000580 - The Apache web server document directory must be in a separate partition from the Apache web servers system files.

800-53|SC-3

CCI|CCI-001084

Rule-ID|SV-214382r961131_rule

STIG-ID|AS24-W2-000580

STIG-Legacy|SV-102637

STIG-Legacy|V-92549

Vuln-ID|V-214382

AS24-W2-000610 - The Apache web server must display a default hosted application web page, not a directory listing, when a requested web page cannot be found.

800-53|SI-11a.

CCI|CCI-001312

Rule-ID|SV-214383r961167_rule

STIG-ID|AS24-W2-000610

STIG-Legacy|SV-102641

STIG-Legacy|V-92553

Vuln-ID|V-214383

AS24-W2-000620 - Warning and error messages displayed to clients must be modified to minimize the identity of the Apache web server, patches, loaded modules, and directory paths.

Rule-ID|SV-214384r961167_rule

STIG-ID|AS24-W2-000620

STIG-Legacy|SV-102643

STIG-Legacy|V-92555

Vuln-ID|V-214384

AS24-W2-000630 - Debugging and trace information used to diagnose the Apache web server must be disabled.

Rule-ID|SV-214385r961167_rule

STIG-ID|AS24-W2-000630

STIG-Legacy|SV-102645

STIG-Legacy|V-92557

Vuln-ID|V-214385

AS24-W2-000640 - The Apache web server must set an absolute timeout for sessions.

800-53|AC-12

CCI|CCI-002361

Rule-ID|SV-214386r1043182_rule

STIG-ID|AS24-W2-000640

STIG-Legacy|SV-102647

STIG-Legacy|V-92559

Vuln-ID|V-214386

AS24-W2-000650 - The Apache web server must set an inactive timeout for completing the TLS handshake - mod_reqtimeout

Rule-ID|SV-214387r1043182_rule

STIG-ID|AS24-W2-000650

STIG-Legacy|SV-102649

STIG-Legacy|V-92561

Vuln-ID|V-214387

AS24-W2-000650 - The Apache web server must set an inactive timeout for completing the TLS handshake - RequestReadTimeout

AS24-W2-000670 - The Apache web server must restrict inbound connections from nonsecure zones.

800-53|AC-17(1)

CCI|CCI-002314

Rule-ID|SV-214388r961278_rule

Detections

Analytics

DISA Apache Server 2.4 Windows Site STIG v2r2

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous