Detections
Analytics
VCPF-67-000022 - Performance Charts must not show directory listings.
Information
Enumeration techniques, such as URL parameter manipulation, rely on being able to obtain information about the web server's directory structure by locating directories without default pages. In the scenario, the web server will display to the user a listing of the files in the directory being accessed. Ensuring that directory listing is disabled is one approach to mitigating the vulnerability.Solution
Navigate to and open /usr/lib/vmware-perfcharts/tc-instance/conf/web.xml.Set the <param-value> to 'false' in all <param-name>listing</param-name> nodes.
Note: The setting should look like the following:
<init-param>
<param-name>listings</param-name>
<param-value>false</param-value>
</init-param>
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_Y23M07_STIG.zip
Item Details
Category: SYSTEM AND INFORMATION INTEGRITY
References: 800-53|SI-11a., CAT|II, CCI|CCI-001312, Rule-ID|SV-239423r879655_rule, STIG-ID|VCPF-67-000022, Vuln-ID|V-239423
Plugin: Unix
Control ID: 9c59ef3fe19762ea89da1693fec9da6c2953074a0e40693f2b66b53e45ffd85d