UCF STIG Viewer Logo

The vCenter UI service must be configured to limit data exposure between applications.


Finding ID Version Rule ID IA Controls Severity
V-259112 VCUI-80-000057 SV-259112r935240_rule Medium
If RECYCLE_FACADES is true or if a security manager is in use, a new facade object will be created for each request. This reduces the chances that a bug in an application might expose data from one request to another.
VMware vSphere 8.0 vCenter Appliance User Interface (UI) Security Technical Implementation Guide 2023-10-29


Check Text ( C-62852r935238_chk )
At the command line, run the following command:

# grep RECYCLE_FACADES /usr/lib/vmware-vsphere-ui/server/conf/catalina.properties

Example result:


If "org.apache.catalina.connector.RECYCLE_FACADES" is not set to "true", this is a finding.

If the "org.apache.catalina.connector.RECYCLE_FACADES" setting does not exist, this is not a finding.
Fix Text (F-62761r935239_fix)
Navigate to and open:


Update or remove the following line:


Restart the service with the following command:

# vmon-cli --restart vsphere-ui