OpenControls Logo

STIG Viewer

STIGViewer Support

The vCenter Server user roles must be verified.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-258921VCSA-80-000095SV-258921r1117171_ruleCCI-001082medium
Description
Users and service accounts must only be assigned privileges they require. Least privilege requires that these privileges must only be assigned if needed to reduce risk of confidentiality, availability, or integrity loss. Satisfies: SRG-APP-000211, SRG-APP-000233, SRG-APP-000380
STIGDate
VMware vSphere 8.0 vCenter Security Technical Implementation Guide2026-05-23

Related Frameworks

3 mappings across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CHG-04.1Automated Access Enforcement / Auditing
1.00
SEA-03.2Application Partitioning
1.00
END-16Restrict Access To Security Functions
0.50
SEA-04.1Security Function Isolation
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (60) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(13)Attribute-based Access Control
1.00
AC-3(4)Discretionary Access Control
1.00

+50 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.13.3
1.00
CCI3 mappings
CCI-001082
1.00
CCI-001084
1.00
CCI-001813
1.00

Details

Check Text (C-258921r1117171_chk)

From the vSphere Client, go to Administration >> Access Control >> Roles. View each role and verify the users and/or groups assigned to it by clicking on "Usage". or From a PowerCLI command prompt while connected to the vCenter server, run the following command: Get-VIPermission | Sort Role | Select Role,Principal,Entity,Propagate,IsGroup | FT -Auto Application service account and user required privileges should be documented. If any user or service account has more privileges than required, this is a finding.

Fix Text (F-62570r934420_fix)

To update a user's or group's permissions to an existing role with reduced permissions, do the following: From the vSphere Client, go to Administration >> Access Control >> Global Permissions. Select the user or group, click the pencil button, change the assigned role, and click "OK". Note: If permissions are assigned on a specific object, the role must be updated where it is assigned (for example, at the cluster level). To create a new role with reduced permissions, do the following: From the vSphere Client, go to Administration >> Access Control >> Roles. Click the green plus sign and enter a name for the role and select only the specific permissions required. Users can then be assigned to the newly created role.