Detections
Analytics

VCPF-80-000140 The vCenter Perfcharts service xpoweredBy attribute must be disabled.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Individual connectors can be configured to display the Tomcat information to clients. This information can be used to identify server versions that can be useful to attackers for identifying vulnerable versions of Tomcat. Individual connectors must be checked for the xpoweredBy attribute to ensure they do not pass server information to clients. The default value for xpoweredBy is 'false'.

Solution

Navigate to and open:

/usr/lib/vmware-perfcharts/tc-instance/conf/server.xml

Navigate to the <Connector> node and remove the "xpoweredBy" attribute.

Restart the service with the following command:

# vmon-cli --restart perfcharts

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_8-0_Y24M08_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000381, Rule-ID|SV-259096r960963_rule, STIG-ID|VCPF-80-000140, Vuln-ID|V-259096

Plugin: Unix

Control ID: 04e317a7941707f5cc1ed2a6d616d5cf1ef209f1b78981a5ed2530c14d483997