Detections
Analytics

1.2 VCPF-80-000005

Information

The vCenter Perfcharts service cookies must have secure flag set.

GROUP ID: V-259072RULE ID: SV-259072r960792

The secure flag is an option that can be set by the application server when sending a new cookie to the user within an HTTP Response. The purpose of the secure flag is to prevent cookies from being observed by unauthorized parties due to the transmission of a cookie in clear text.

By setting the secure flag, the browser will prevent the transmission of a cookie over an unencrypted channel.

Solution

Navigate to and open:

/usr/lib/vmware-perfcharts/tc-instance/webapps/statsreport/WEB-INF/web.xml

Navigate to the node and configure the setting as follows:

Restart the service with the following command:

vmon-cli --restart perfcharts

See Also

https://workbench.cisecurity.org/benchmarks/23627

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3, CAT|II, CCI|CCI-000213, Rule-ID|SV-259072r960792_rule, STIG-ID|VCPF-80-000005, Vuln-ID|V-259072

Plugin: Unix

Control ID: 93b6656c58ba092c31500e934c5ba425e5eeaeb47c1d431ec9a19f1c03a98835