Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The application server management interface must provide a logout capability for user-initiated communication session.
Description
Discussion Text
If a user cannot explicitly end an application server management interface session, the session may remain open and be exploited by an attacker; this is referred to as a zombie session.
The attacker will then have access to the application server management functions without going through the user authentication process.
To prevent this type of attack, the application server management interface must close user sessions when defined events are met and provide a logout function for users to explicitly close the session and free resources that were in use by the user.
The attacker will then have access to the application server management functions without going through the user authentication process.
To prevent this type of attack, the application server management interface must close user sessions when defined events are met and provide a logout function for users to explicitly close the session and free resources that were in use by the user.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.