VMware vSphere 6.7 EAM Tomcat Security Technical Implementation Guide

Version: 1

Updated: 20 Jul 2023

Findings: 31

Findings

V-239372 - ESX Agent Manager must limit the amount of time that each TCP connection is kept alive. (medium)
V-239373 - ESX Agent Manager must limit the number of concurrent connections permitted. (medium)
V-239374 - ESX Agent Manager must limit the maximum size of a POST request. (medium)
V-239375 - ESX Agent Manager must protect cookies from XSS. (medium)
V-239376 - ESX Agent Manager must record user access in a format that enables monitoring of remote access. (medium)
V-239377 - ESX Agent Manager must generate log records for system startup and shutdown. (medium)
V-239378 - ESX Agent Manager log files must only be modifiable by privileged users. (medium)
V-239379 - ESX Agent Manager application files must be verified for their integrity. (medium)
V-239380 - ESX Agent Manager must only run one webapp. (medium)
V-239381 - ESX Agent Manager must not be configured with unsupported realms. (medium)
V-239382 - ESX Agent Manager must be configured to limit access to internal packages. (medium)
V-239383 - ESX Agent Manager must have Multipurpose Internet Mail Extensions (MIMEs) that invoke operating system shell programs disabled. (medium)
V-239384 - ESX Agent Manager must have mappings set for Java servlet pages. (medium)
V-239385 - ESX Agent Manager must not have the Web Distributed Authoring (WebDAV) servlet installed. (medium)
V-239386 - ESX Agent Manager must be configured with memory leak protection. (medium)
V-239387 - ESX Agent Manager must not have any symbolic links in the web content directory tree. (medium)
V-239388 - ESX Agent Manager directory tree must have permissions in an "out-of-the box" state. (medium)
V-239389 - ESX Agent Manager must fail to a known safe state if system initialization fails, shutdown fails, or aborts fail. (medium)
V-239390 - ESX Agent Manager must limit the number of allowed connections. (medium)
V-239391 - ESX Agent Manager must set "URIEncoding" to UTF-8. (medium)
V-239392 - ESX Agent Manager must use the "setCharacterEncodingFilter" filter. (medium)
V-239393 - ESX Agent Manager must set the welcome-file node to a default web page. (medium)
V-239394 - ESX Agent Manager must not show directory listings. (medium)
V-239395 - ESX Agent Manager must be configured to show error pages with minimal information. (medium)
V-239396 - ESX Agent Manager must not enable support for TRACE requests. (medium)
V-239397 - ESX Agent Manager must have the debug option turned off. (medium)
V-239398 - Rsyslog must be configured to monitor and ship ESX Agent Manager log files. (medium)
V-239399 - ESX Agent Manager must set the secure flag for cookies. (medium)
V-239400 - ESX Agent Manager must be configured with the appropriate ports. (medium)
V-239401 - ESX Agent Manager must disable the shutdown port. (medium)
V-257277 - The version of EAM running on the system must be a supported version. (high)