Oracle WebLogic must separate hosted application functionality from Oracle WebLogic management functionality.
An XCCDF Rule
Description
<VulnDiscussion>Application server management functionality includes functions necessary to administer the application server and requires privileged access via one of the accounts assigned to a management role. The separation of application server administration functionality from hosted application functionality is either physical or logical and is accomplished by using different computers, different central processing units, different instances of the operating system, network addresses, network ports, or combinations of these methods, as appropriate.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-235983r628727_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
1. Access AC
2. From 'Domain Structure', select 'Environment' -> 'Servers'
3. A single server in the list will be named 'Admin Server' and this is the server which hosts AS management functionality, such as the AdminConsole application
4. All remaining servers in the list are 'Managed Servers' and these are the individual or clustered servers which will host the actual applications
5. Utilize 'Change Center' to create a new change session
6. Undeploy all applications that are not used for AS management from the Admin server, and redeploy onto the Managed servers