VMware vSphere 6.7 UI Tomcat Security Technical Implementation Guide

The VMware vSphere 6.7 UI Tomcat Security Technical Implementation Guide (V1 R3) has 33 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

33STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R3

CurrentPublished Wed Jul 26 2023 What changed in V1R3

vSphere UI plugins must be authorized before use.

VMware vSphere 6.7 UI Tomcat Security Technical Implementation Guide

Assessment Title

Rule Text

vSphere UI plugins must be authorized before use.

Description

Discussion Text

The vSphere UI ships with a number of plugins out of the box. Any additional plugins may affect the availability and integrity of the system and must be approved and documented by the ISSO before deployment.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-239690

Rule

SV-239690r879584_rule

Severity

medium

Rule Version

VCUI-67-000009

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

At the command prompt, execute the following command:

# diff <(find /usr/lib/vmware-vsphere-ui/plugin-packages/vsphere-client/plugins -type f|sort) <(rpm -ql vsphere-ui|grep "/usr/lib/vmware-vsphere-ui/plugin-packages/vsphere-client/plugins/"|sort)

If there is any output, this indicates a vSphere UI plugin is present that does not ship with the VCSA. 

If this plugin is not known and approved, this is a finding.

Implementation Procedure

Fix Text

For every unauthorized plugin returned by the check, run the following command.

# rm <file>

STIG check 9 of 33 in the VMware vSphere 6.7 UI Tomcat STIG checklist

← Previous · V-239689vSphere UI application files must be verified for their integrity.Next · V-239691 →vSphere UI must be configured to limit access to internal packages.