Apache Tomcat Application Server 9 Security Technical Implementation Guide

The Apache Tomcat Application Server 9 Security Technical Implementation Guide (V3 R5) has 79 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

79STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R5

CurrentPublished Wed Sep 30 2026

Tomcat users in a management role must be approved by the ISSO.

Apache Tomcat Application Server 9 Security Technical Implementation Guide

Assessment Title

Rule Text

Tomcat users in a management role must be approved by the ISSO.

Description

Discussion Text

Deploying applications to Tomcat requires a Tomcat user account that is in the "manager-script" role. Any user accounts in a Tomcat management role must be approved by the ISSO.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-223006

Rule

SV-223006r1264598_rule

Severity

medium

Rule Version

TCAT-AS-001700

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Review the Tomcat servers System Security Plan/server documentation.

Ensure that user accounts and roles with access to Tomcat management features such as the "manager-script" role are documented and approved by the ISSO.

If the ISSO has not approved of documented roles and users who have management rights to the Tomcat server, this is a finding.

Implementation Procedure

Fix Text

Document the users and the roles that have been defined for use with the Tomcat server.

Ensure that all users and roles with access to Tomcat management features and capabilities are approved by the ISSO.

STIG check 75 of 79 in the Apache Tomcat Application Server 9 STIG checklist

← Previous · V-223005ENFORCE_ENCODING_IN_GET_WRITER must be set to true.Next · V-223007 →Hosted applications must be documented in the system security plan.