AS24-W2-000240 - The Apache web server must not perform user management for hosted applications.

800-53|CM-7a.

CAT|II

CCI|CCI-000381

Rule-ID|SV-214365r960963_rule

STIG-ID|AS24-W2-000240

STIG-Legacy|SV-102591

STIG-Legacy|V-92503

Vuln-ID|V-214365

AS24-W2-000310 - The Apache web server must allow the mappings to unused and vulnerable scripts to be removed.

Rule-ID|SV-214367r960963_rule

STIG-ID|AS24-W2-000310

STIG-Legacy|SV-102595

STIG-Legacy|V-92507

Vuln-ID|V-214367

AS24-W2-000350 - Users and scripts running on behalf of users must be contained to the document root or home directory tree of the Apache web server.

Rule-ID|SV-214368r960963_rule

STIG-ID|AS24-W2-000350

STIG-Legacy|SV-102599

STIG-Legacy|V-92511

Vuln-ID|V-214368

AS24-W2-000390 - Only authenticated system administrators or the designated PKI Sponsor for the Apache web server must have access to the Apache web servers private key.

800-53|IA-5(2)(b)

CCI|CCI-000186

Rule-ID|SV-214371r961041_rule

STIG-ID|AS24-W2-000390

STIG-Legacy|SV-102607

STIG-Legacy|V-92519

Vuln-ID|V-214371

AS24-W2-000430 - Apache web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.

800-53|SC-2

CCI|CCI-001082

Rule-ID|SV-214372r1138072_rule

STIG-ID|AS24-W2-000430

STIG-Legacy|SV-102615

STIG-Legacy|V-92527

Vuln-ID|V-214372

AS24-W2-000440 - Anonymous user access to the Apache web server application directories must be prohibited.

800-53|CM-5(1)

CAT|I

CCI|CCI-001813

Rule-ID|SV-214373r1138073_rule

STIG-ID|AS24-W2-000440

STIG-Legacy|SV-102617

STIG-Legacy|V-92529

Vuln-ID|V-214373

AS24-W2-000450 - The Apache web server must separate the hosted applications from hosted Apache web server management functionality.

Rule-ID|SV-214374r1138074_rule

STIG-ID|AS24-W2-000450

STIG-Legacy|SV-102619

STIG-Legacy|V-92531

Vuln-ID|V-214374

AS24-W2-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - Header HttpOnly Secure

800-53|SC-23(3)

CCI|CCI-001664

Rule-ID|SV-214376r1043180_rule

STIG-ID|AS24-W2-000470

STIG-Legacy|SV-102623

STIG-Legacy|V-92535

Vuln-ID|V-214376

AS24-W2-000540 - The Apache web server must augment re-creation to a stable and known baseline.

800-53|SC-24

CCI|CCI-001190

Rule-ID|SV-214380r961122_rule

STIG-ID|AS24-W2-000540

STIG-Legacy|SV-102633

STIG-Legacy|V-92545

Vuln-ID|V-214380

AS24-W2-000580 - The Apache web server document directory must be in a separate partition from the Apache web servers system files.

800-53|SC-3

CCI|CCI-001084

Rule-ID|SV-214382r961131_rule

STIG-ID|AS24-W2-000580

STIG-Legacy|SV-102637

STIG-Legacy|V-92549

Vuln-ID|V-214382

AS24-W2-000610 - The Apache web server must display a default hosted application web page, not a directory listing, when a requested web page cannot be found.

800-53|SI-11a.

CCI|CCI-001312

Rule-ID|SV-214383r961167_rule

STIG-ID|AS24-W2-000610

STIG-Legacy|SV-102641

STIG-Legacy|V-92553

Vuln-ID|V-214383

AS24-W2-000670 - The Apache web server must restrict inbound connections from nonsecure zones.

800-53|AC-17(1)

CCI|CCI-002314

Rule-ID|SV-214388r961278_rule

STIG-ID|AS24-W2-000670

STIG-Legacy|SV-102653

STIG-Legacy|V-92565

Vuln-ID|V-214388

AS24-W2-000690 - Non-privileged accounts on the hosting system must only access Apache web server security-relevant information and functions through a distinct administrative account.

800-53|AC-6(10)

CCI|CCI-002235

Rule-ID|SV-214389r961353_rule

STIG-ID|AS24-W2-000690

STIG-Legacy|SV-102655

STIG-Legacy|V-92567

Vuln-ID|V-214389

AS24-W2-000780 - The Apache web server must prohibit or restrict the use of nonsecure or unnecessary ports, protocols, modules, and/or services.

800-53|CM-6b.

800-53|CM-7(1)(b)

CCI|CCI-000366

CCI|CCI-001762

Rule-ID|SV-214390r1192950_rule

STIG-ID|AS24-W2-000780

STIG-Legacy|SV-102661

STIG-Legacy|V-92573

Vuln-ID|V-214390

AS24-W2-000870 - Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data

800-53|SC-8

CCI|CCI-002418

Rule-ID|SV-214394r961632_rule

STIG-ID|AS24-W2-000870

STIG-Legacy|SV-102943

STIG-Legacy|V-92855

Vuln-ID|V-214394

AS24-W2-000880 - Cookies exchanged between the Apache web server and the client, such as session cookies, must have cookie properties set to force the encryption of cookies

Rule-ID|SV-214395r961632_rule

STIG-ID|AS24-W2-000880

STIG-Legacy|SV-102675

STIG-Legacy|V-92587

Vuln-ID|V-214395

DISA_STIG_Apache_Site-2.4_Windows_v2r3.audit from DISA Apache Server 2.4 Windows Site v2r3 STIG

Detections

Analytics

DISA Apache Server 2.4 Windows Site STIG v2r3

Audit Details

File Details

Audit Changelog

No revisions found