Capacity
CCI-001664
Recognize only session identifiers that are system-generated.
8
Rule
Severity: Medium
Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application.
4
Rule
Severity: Medium
The Apache web server must accept only system-generated session identifiers.
2
Rule
Severity: Medium
The ALG must recognize only system-generated session identifiers.
2
Rule
Severity: Medium
The application server must generate a unique session identifier for each session.
2
Rule
Severity: Medium
The application server must recognize only system-generated session identifiers.
2
Rule
Severity: Medium
Applications must use system-generated session identifiers that protect against session fixation.
2
Rule
Severity: Medium
Applications must validate session identifiers.
2
Rule
Severity: Medium
Applications must not use URL embedded session IDs.
2
Rule
Severity: Medium
The application must not re-use or recycle session IDs.
1
Rule
Severity: Medium
The DataPower Gateway must recognize only system-generated session identifiers.
1
Rule
Severity: Medium
The MQ Appliance messaging server must ensure authentication of both SSH client and server during the entire session.
2
Rule
Severity: Medium
The network device must recognize only system-generated session identifiers.
2
Rule
Severity: Medium
The UEM server must recognize only system-generated session identifiers.
2
Rule
Severity: Medium
The VPN Gateway must recognize only system-generated session identifiers.
2
Rule
Severity: High
The Apache web server must generate a session ID using as much of the character set as possible to reduce the risk of brute force.
2
Rule
Severity: Low
Tomcat must be configured to limit data exposure between applications.
2
Rule
Severity: Medium
The DBMS must recognize only system-generated session identifiers.
2
Rule
Severity: Medium
The IIS 10.0 web server must use cookies to track session state.
2
Rule
Severity: Medium
The IIS 10.0 web server must accept only system-generated session identifiers.
2
Rule
Severity: Medium
Redis Enterprise DBMS must recognize only system-generated session identifiers.
2
Rule
Severity: Medium
Cookies exchanged between any Automation Controller NGINX web server and any client, such as session cookies, must have security settings that disallow cookie access outside the originating Automation Controller NGINX web server and hosted application.
1
Rule
Severity: Medium
ESX Agent Manager must protect cookies from cross-site scripting (XSS).
1
Rule
Severity: Medium
Lookup Service must protect cookies from cross-site scripting (XSS).
3
Rule
Severity: Medium
The vCenter ESX Agent Manager service must be configured to limit data exposure between applications.
1
Rule
Severity: Medium
The Security Token Service must protect cookies from cross-site scripting (XSS).
3
Rule
Severity: Medium
The vCenter Lookup service must be configured to limit data exposure between applications.
1
Rule
Severity: Medium
vSphere UI must restrict its cookie path.
3
Rule
Severity: Medium
The vCenter Perfcharts service must be configured to limit data exposure between applications.
3
Rule
Severity: Medium
The vCenter STS service must be configured to limit data exposure between applications.
3
Rule
Severity: Medium
The vCenter UI service must be configured to limit data exposure between applications.
2
Rule
Severity: Medium
Cookies exchanged between the web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating web server and hosted application.
2
Rule
Severity: Medium
The web server must accept only system-generated session identifiers.
2
Rule
Severity: Low
When the Access Profile Type is LTM+APM and it is not using any connectivity resources (such as Network Access, Portal Access, etc.) in the VPE, the F5 BIG-IP appliance must be configured to enable the HTTP Only flag.
1
Rule
Severity: Low
The F5 BIG-IP appliance must be configured to enable the "Secure" cookie flag.
1
Rule
Severity: Low
The F5 BIG-IP appliance must be configured to disable the "Persistent" cookie flag.
1
Rule
Severity: Low
The F5 BIG-IP appliance must be configured to enable the secure cookie flag.
1
Rule
Severity: Low
The F5 BIG-IP appliance must be configured to disable the persistent cookie flag.
Patternfly
PatternFly elements
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.
Modules