OpenControls Logo

STIG Viewer

STIGViewer Support

The vCenter UI service must limit privileges for creating or modifying hosted application shared files.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-259109VCUI-80-000034SV-259109r960960_ruleCCI-001499medium
Description
Application servers have the ability to specify that the hosted applications use shared libraries. The application server must have a capability to divide roles based upon duties wherein one project user (such as a developer) cannot modify the shared library code of another project user. The application server must also be able to specify that nonprivileged users cannot modify any shared library code at all. Ensuring the Security Lifecycle Listener element is uncommented and sets a minimum Umask value will allow the server to perform a number of security checks when starting and prevent the service from starting if they fail.
STIGDate
VMware vSphere 8.0 vCenter Appliance User Interface (UI) Security Technical Implementation Guide2026-05-23

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CHG-04.5Library Privileges
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (56) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(7)Role-based Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00

+46 more (top 10 by confidence shown)

CCI1 mapping
CCI-001499
1.00

Details

Check Text (C-259109r960960_chk)

At the command prompt, run the following command: # xmllint --xpath '/Server/Listener[@className="org.apache.catalina.security.SecurityListener"]' /usr/lib/vmware-vsphere-ui/server/conf/server.xml Example result: <Listener className="org.apache.catalina.security.SecurityListener"/> If the "org.apache.catalina.security.SecurityListener" listener is not present, this is a finding. If the "org.apache.catalina.security.SecurityListener" listener is configured with a "minimumUmask" and is not "0007", this is a finding.

Fix Text (F-62758r935230_fix)

Navigate to and open: /usr/lib/vmware-vsphere-ui/server/conf/server.xml Navigate to the <Server> node and add or update the "org.apache.catalina.security.SecurityListener" as follows: <Listener className="org.apache.catalina.security.SecurityListener"/> Restart the service with the following command: # vmon-cli --restart vsphere-ui