1.1 Remove extraneous files and directories - /conf/Catalina/localhost/host-manager.xml

800-53|CM-7b.

CSCv6|9.1

1.1 Remove extraneous files and directories - /conf/Catalina/localhost/manager.xml

1.1 Remove extraneous files and directories - /server/webapps/host-manager.xml

1.1 Remove extraneous files and directories - /server/webapps/manager

1.1 Remove extraneous files and directories - /webapps/balancer

1.1 Remove extraneous files and directories - /webapps/examples

1.1 Remove extraneous files and directories - /webapps/js-examples

1.1 Remove extraneous files and directories - /webapps/ROOT/admin

1.1 Remove extraneous files and directories - /webapps/servlet-example

1.1 Remove extraneous files and directories - /webapps/tomcat-docs

1.1 Remove extraneous files and directories - /webapps/webdav

800-53|SI-4

CSCv7|9.2

2.1 Alter the Advertised server.info String

800-53|CM-7

CSCv7|13.2

2.2 Alter the Advertised server.number String

2.3 Alter the Advertised server.built Date

2.4 Disable X-Powered-By HTTP Header and Rename the Server Value for all Connectors

2.7 Ensure Sever Header is Modified To Prevent Information Disclosure

800-53|AC-3

CSCv7|14.6

800-53|CM-6

CSCv7|5.1

800-53|IA-5

800-53|IA-5(1)

CSCv7|16.4

800-53|AU-12

CSCv6|3.1

CSCv7|6.3

7.3 Ensure className is set correctly in context.xml

9.2 Disabling auto deployment of applications

9.3 Disable deploy on startup of applications

10.2 Restrict access to the web administration application

800-53|AC-6(10)

CSCv7|4.7

10.5 Rename the manager application - host-manager/manager.xml

10.5 Rename the manager application - localhost/manager.xml

10.5 Rename the manager application - webapps/manager

10.8 Do not allow additional path delimiters - ALLOW_BACKSLASH

10.8 Do not allow additional path delimiters - ALLOW_ENCODED_SLASH

10.9 Do not allow custom header status messages

800-53|SC-8

CSCv7|14.4

10.16 Do not resolve hosts on logging valves

CIS_Apache_Tomcat_8_L2_v1.1.0_Middleware.audit from CIS Apache Tomcat 8 Benchmark

Detections

Analytics

Revision 1.11

Jun 17, 2024

Miscellaneous