Performance Charts must only run one webapp.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-256619	VCPF-70-000009	SV-256619r888348_rule	CCI-001749	medium
Description
VMware ships Performance Charts on the vCenter Server Appliance (VCSA)with one webapp. Any other path is potentially malicious and must be removed.
STIG			Date
VMware vSphere 7.0 vCenter Appliance Perfcharts Security Technical Implementation Guide			2023-02-21

Related Frameworks

1 mapping across 2 frameworks

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (12) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(10)Shared and Group Account Credential Change

1.00

DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-4Audit Log Storage Capacity

1.00

DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-14Signed Components

1.00

DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA STIG Benchmark (XCCDF)3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-5(1)Automated Access Enforcement and Audit Records

1.00

DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-5(3)Signed Components

1.00

DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-7Least Functionality

1.00

DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-7(5)Authorized Software — Allow-by-exception

1.00

DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-2(5)Individual Authentication with Group Authentication

1.00

DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-2Separation of System and User Functionality

1.00

DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-23Session Authenticity

1.00

DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

+2 more (top 10 by confidence shown)

CCI1 mapping

CCI-001749

1.00

DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)

Details

Check Text (C-256619r888348_chk)

At the command prompt, run the following command: # ls -A /usr/lib/vmware-perfcharts/tc-instance/webapps Expected result: statsreport If the output does not match the expected result, this is a finding.

Fix Text (F-60237r888347_fix)

For each unexpected directory returned in the check, run the following command: # rm /usr/lib/vmware-perfcharts/tc-instance/webapps/<NAME> Restart the service with the following command: # vmon-cli --restart perfcharts