Detections
Analytics

WBSP-AS-000020 - The WebSphere Application Server admin console session timeout must be configured.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

An attacker can take advantage of user sessions that are left open, thus bypassing the user authentication process.

To thwart the vulnerability of open and unused user sessions, the application server must be configured to close the sessions when a configured condition or trigger event is met.

Session termination terminates all processes associated with a user's logical session except those processes that are specifically created by the user (i.e., session owner) to continue after the session is terminated.

Conditions or trigger events requiring automatic session termination can include, for example, periods of user inactivity, targeted responses to certain types of incidents, and time-of-day restrictions on information system use.

Solution

Locate the deployment.xml file. The default file locations where deployment.xml is installed are provided below.

UNIX:
/opt/IBM/WebSphere/Profiles/DefaultDmgr01/config/cells/<CELL NAME>/applications/isclite.ear/deployments/isclite/

Windows:
C:Program FilesIBMWebSphereProfilesDefaultDmgr01configcells<CELL NAME>applicationsisclite.eardeploymentsisclite

Make a backup copy of the deployment.xml file.

Edit the deployment.xml file.

Modify the 'invalidationtimeout=' value and set to '10'.

Restart the DMGR and all the JVMs.

See Also

http://iasecontent.disa.mil/stigs/zip/U_IBM_WebSphere_Traditional_V9-x_V1R1_STIG.zip

Item Details

References: CAT|II, CCI|CCI-002361, Rule-ID|SV-95909r1_rule, STIG-ID|WBSP-AS-000020, Vuln-ID|V-81195

Plugin: Unix

Control ID: cf8ffecae440e9cb26e6c78b5d0d186431ae4bfab83add77b2dbf0f25d9517aa