Apache Tomcat Application Server 9 Security Technical Implementation Guide

The Apache Tomcat Application Server 9 Security Technical Implementation Guide (V3 R5) has 79 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

79STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R5

CurrentPublished Wed Sep 30 2026

Example applications must be removed.

Apache Tomcat Application Server 9 Security Technical Implementation Guide

Assessment Title

Rule Text

Example applications must be removed.

Description

Discussion Text

Tomcat provides example applications, documentation, and other directories in the default installation which do not serve a production use. These files must be deleted.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-222958

Rule

SV-222958r1264548_rule

Severity

low

Rule Version

TCAT-AS-000560

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

From the Tomcat server OS type the following command:

sudo ls -l $CATALINA_BASE/webapps/examples. 

If the examples folder exists or contains any content, this is a finding.

Implementation Procedure

Fix Text

From the Tomcat server OS type the following command:

 sudo rm -rf $CATALINA_BASE/webapps/examples

STIG check 30 of 79 in the Apache Tomcat Application Server 9 STIG checklist

← Previous · V-222957xpoweredBy attribute must be disabled.Next · V-222959 →Tomcat default ROOT web application must be removed.