| 2.2 Alter the Advertised server.number String | CIS Apache Tomcat 10.1 v1.1.0 L2 | Unix | CONFIGURATION MANAGEMENT |
| 2.2 Alter the Advertised server.number String | CIS Apache Tomcat 11 v1.0.0 L2 | Unix | CONFIGURATION MANAGEMENT |
| 2.6 Ensure the Proxy Modules Are Disabled if not in use | CIS Apache HTTP Server 2.4 v2.3.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 2.7 Ensure Sever Header is Modified To Prevent Information Disclosure | CIS Apache Tomcat 10 L2 v1.1.0 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 2.7 Ensure Sever Header is Modified To Prevent Information Disclosure | CIS Apache Tomcat 9 L2 v1.2.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.12 Ensure Group Write Access for the Document Root Directories and Files Is Properly Restricted | CIS Apache HTTP Server 2.2 L1 v3.6.0 | Unix | ACCESS CONTROL |
| 3.12 Ensure Group Write Access for the Document Root Directories and Files Is Properly Restricted | CIS Apache HTTP Server 2.2 L1 v3.6.0 Middleware | Unix | ACCESS CONTROL |
| 3.12 Ensure Group Write Access for the Document Root Directories and Files Is Properly Restricted | CIS Apache HTTP Server 2.2 L2 v3.6.0 | Unix | ACCESS CONTROL |
| 12.3 Ensure the Apache AppArmor Profile Is in Enforce Mode | CIS Apache HTTP Server 2.2 L2 v3.6.0 | Unix | CONFIGURATION MANAGEMENT |
| 12.3 Ensure the Apache AppArmor Profile Is in Enforce Mode | CIS Apache HTTP Server 2.2 L2 v3.6.0 Middleware | Unix | CONFIGURATION MANAGEMENT |
| WA000-WWA020 A22 - The Timeout directive must be properly set. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WA000-WWA028 A22 - The httpd.conf MinSpareServers directive must be set properly. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WA000-WWA050 A22 - All interactive programs must be placed in a designated directory with appropriate permissions - conf | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WA000-WWA050 A22 - All interactive programs must be placed in a designated directory with appropriate permissions - printenv | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WA000-WWA052 A22 - The '-FollowSymLinks' setting must be disabled. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | CONFIGURATION MANAGEMENT |
| WA000-WWA054 A22 - Server side includes (SSIs) must run with execution capability disabled - None | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WA000-WWA056 A22 - The MultiViews directive must be disabled. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | CONFIGURATION MANAGEMENT |
| WA000-WWA060 A22 - The HTTP request message body size must be limited. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WA000-WWA062 A22 - The HTTP request header fields must be limited. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WA000-WWA066 A22 - The HTTP request line must be limited. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WA070 A22 - A private web server must be located on a separate controlled access subnet. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WA140 A22 - Web server content and configuration files must be part of a routine backup program. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WA00525 A22 - User specific directories must not be globally enabled. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WA00535 A22 - The score board file must be properly secured. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WA00540 A22 - The web server must be configured to explicitly deny access to the OS root - Deny | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WA00540 A22 - The web server must be configured to explicitly deny access to the OS root - Order | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WA00555 A22 - The web server must be configured to listen on a specific IP address and port - 0.0.0.0:80 | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WA00555 A22 - The web server must be configured to listen on a specific IP address and port - 80 | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WA00555 A22 - The web server must be configured to listen on a specific IP address and port - listen | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WA00565 A22 - HTTP request methods must be limited - Deny | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WA00565 A22 - HTTP request methods must be limited - LimitExcept | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WA00565 A22 - HTTP request methods must be limited - Order | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WBLC-05-000176 - Oracle WebLogic must use cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance when encrypting stored data - PRE_CLASSPATH | Oracle WebLogic Server 12c Windows v2r2 | Windows | IDENTIFICATION AND AUTHENTICATION |
| WBLC-08-000214 - Oracle WebLogic must utilize NSA-approved cryptography when protecting classified compartmentalized data - JAVA_OPTIONS | Oracle WebLogic Server 12c Windows v2r2 | Windows | CONFIGURATION MANAGEMENT |
| WG080 A22 - Installation of a compiler on production web server is prohibited. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WG130 A22 - All utility programs, not necessary for operations, must be removed or disabled. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | CONFIGURATION MANAGEMENT |
| WG200 A22 - Administrators must be the only users allowed access to the directory tree, the shell, or other operating system functions and utilities. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | ACCESS CONTROL |
| WG204 A22 - A web server must be segregated from other services. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WG220 A22 - Web administration tools must be restricted to the web manager and the web manager's designees - ResourceConfig | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WG270 A22 - The web server's htpasswd files (if present) must reflect proper ownership and permissions | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WG280 - The access control files are owned by a privileged web server account - APP_Config_files | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WG330 A22 - A public web server must limit email to outbound only - netstat | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | CONFIGURATION MANAGEMENT |
| WG330 A22 - A public web server must limit email to outbound only - sendmail | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WG345 A22 - The web server must remove all export ciphers from the cipher suite. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| WG355 A22 - A private web server's list of CAs in a trust hierarchy must lead to an authorized DoD PKI Root CA. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WG370 A22 - MIME types for csh or sh shell programs must be disabled - Action | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | CONFIGURATION MANAGEMENT |
| WG370 A22 - MIME types for csh or sh shell programs must be disabled - AddHandler | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | CONFIGURATION MANAGEMENT |
| WG385 A22 - All web server documentation, sample code, example applications, and tutorials must be removed from a production web server. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | CONFIGURATION MANAGEMENT |
| WG420 A22 - Backup interactive scripts on the production web server are prohibited. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
| WG440 A22 - Monitoring software must include CGI or equivalent programs in its scope. | DISA STIG Apache Server 2.2 Unix v1r11 Middleware | Unix | |
