MarkLogic Server must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accordance with Ports, Protocols, and Services Management (PPSM) guidance.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-220384 | ML09-00-008000 | SV-220384r961470_rule | CCI-001762 | medium |
| Description | ||||
| Use of nonsecure network functions, ports, protocols, and services exposes the system to avoidable threats. | ||||
| STIG | Date | |||
| MarkLogic Server v9 Security Technical Implementation Guide | 2024-09-04 | |||
Related Frameworks
1 mapping across 4 frameworks
Related Frameworks
SCF0 mappings
No source states a mapping between these directly.
Also reachable in 3 hops (1) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)V3R2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to
NIST 800-530 mappings
No source states a mapping between these directly.
Also reachable in 2 hops (6) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)V3R2intersects(normalised)
- DISA STIG Benchmark (XCCDF)7our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)7intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V3R2intersects(normalised)
- DISA STIG Benchmark (XCCDF)7our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)7intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V3R2intersects(normalised)
- DISA STIG Benchmark (XCCDF)V2R7our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)V2R7intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V3R2intersects(normalised)
- DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)1intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V3R2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V3R2intersects(normalised)
- DISA STIG Benchmark (XCCDF)7our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)7intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
NIST 800-1710 mappings
No source states a mapping between these directly.
Also reachable in 3 hops (1) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
3.4.7
1.00
- DISA STIG Benchmark (XCCDF)V3R2intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- NIST SP 800-171 Rev 2, Appendix DRev 2 (Feb 2020, errata Jan 2021)equal to(normalised)
CCI1 mapping
CCI-001762
1.00
- DISA STIG Benchmark (XCCDF)V3R2intersects(normalised)
Details
Check Text (C-220384r961470_chk)
Review the network functions, ports, protocols, and services supported by MarkLogic for any that are prohibited by the PPSM guidance.
Perform the check from the MarkLogic Server Admin Interface with a user that holds administrative-level privileges.
1. Click the Groups icon.
2. Click the group in which the configuration to be checked resides (e.g., Default).
3. Click the App Servers icon on the left tree menu.
4. Inspect the Summary screen for the Type/Port/ and SSL configuration.
5. If any of the App Servers uses a protocol or port prohibited by the PPSM guidance, this is a finding.
Fix Text (F-22088r401604_fix)
Disable each prohibited network function, port, protocol, or service in MarkLogic.
Perform the fix from the MarkLogic Server Admin Interface with a user that holds administrative-level privileges.
1. Click the Groups icon.
2. Click the group in which the configuration to be checked resides (e.g., Default).
3. Click the App Servers icon on the left tree menu.
4. For any App Server that uses a prohibited port or protocol either disable the App Server or reconfigure to be compliant with the PPSM.