Ax-OS must automatically terminate a graphical user interface (GUI) user session after 15 minutes.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-276002	AXOS-00-000010	SV-276002r1122656_rule	CCI-000057	medium
Description
An attacker can take advantage of user sessions that are left open, thus bypassing the user authentication process. To thwart the vulnerability of open and unused user sessions, the application server must be configured to close the sessions when a configured condition or trigger event is met. Session termination ends all processes associated with a user's logical session except those specifically created by the user (i.e., session owner) to continue after the session is terminated. Conditions or trigger events requiring automatic session termination can include, for example, periods of user inactivity, targeted responses to certain types of incidents, and time-of-day restrictions on information system use. Satisfies: SRG-APP-000003, SRG-APP-000190, SRG-APP-000295
STIG			Date
Axonius Federal Systems Ax-OS Security Technical Implementation Guide			2025-11-25

Related Frameworks

1 mapping across 4 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-24Session Lock

0.50

DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2intersects

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (18) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-11Device Lock

1.00

DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-11(1)Pattern-hiding Displays

1.00

DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-12Session Termination

1.00

DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AC-12(2)Termination Message

1.00

DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)DISA STIG Benchmark (XCCDF)V1R7our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)DISA STIG Benchmark (XCCDF)V1R7intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-10Non-repudiation

1.00

DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-7Least Functionality

1.00

DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA STIG Benchmark (XCCDF)7our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)7intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-11Re-authentication

1.00

DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-2Identification and Authentication (Organizational Users)

1.00

DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-2(1)Multi-factor Authentication to Privileged Accounts

1.00

DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-2(12)Acceptance of PIV Credentials

1.00

DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

+8 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.10

1.00

DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
NIST SP 800-171 Rev 2, Appendix DRev 2 (Feb 2020, errata Jan 2021)equal to(normalised)

CCI1 mapping

CCI-000057

1.00

DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)

Details

Check Text (C-276002r1122656_chk)

Select the gear icon (System Settings) >> Privacy and Security >> Session. Under the Session Menu, verify the "Enable session timeout" slide bar is enabled. Verify "Session idle timeout (minutes)" is set to "15". If "Session idle timeout (minutes)" is not set to 15 minutes or less, this is a finding.

Fix Text (F-80045r1122655_fix)

Select the gear icon (System Settings) >> Privacy and Security >> Session. Under the Session Menu, enable the "Enable session timeout" slide bar. Set "Session idle timeout (minutes)" to "15". Click "Save".