WG385 W22 - All web server documentation, sample code, example applications, and tutorials must be removed from a production web server. - 'extra'

Information

Web server documentation, sample code, example applications, and tutorials may be an exploitable threat to a web server. A production web server may only contain components that are operationally necessary (e.g., compiled code, scripts, web-content, etc.). Delete all directories that contain samples and any scripts used to execute the samples. If there is a requirement to maintain these directories at the site on non-production servers for training purposes, have NTFS permissions set to only allow access to authorized users (i.e., web administrators and systems administrators). Sample applications or scripts have not been evaluated and approved for use and may introduce vulnerabilities to the system.

Solution

Ensure sample code and documentation have been removed from the web server.

See Also

https://iasecontent.disa.mil/stigs/zip/U_Apache_2-2_WIN_V1R13_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7b., CAT|I, Rule-ID|SV-33087r1_rule, STIG-ID|WG385_W22, Vuln-ID|V-13621

Plugin: Windows

Control ID: 2bbdf9e44f150f6671c9588ef08ff94bcfa10cb5721fd5aeeadcbaf1df32a390