STIGQter: STIG Summary: zOS WebSphere Application Server for ACF2 Security Technical Implementation Guide Version: 7 Release: 2 Benchmark Date: 01 Oct 2025:

Vendor-supplied user accounts for the WebSphere Application Server must be defined to the ACP.

DISA Rule

SV-224352r1141678_rule

Vulnerability Number

V-224352

Group Title

SRG-OS-000104

Rule Version

ZWAS0040

Severity

CAT I

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
• CCI-001762 - Disable or remove organization-defined functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure.

Weight

10

Fix Recommendation

The ISSO will ensure that the CBADMIN user account is removed or not defined to the ACP.

Check Contents

Refer to the following report produced by the ACP Data Collection:

ACF2
- ACF2CMDS.RPT(LOGONIDS).
RACF
- RACFCMDS.RPT(LISTUSER).
TSS
- TSSCMDS.RPT(@ACIDS).

Automated Analysis requires Additional Analysis.
Refer to the following report produced by the z/OS Data Collection:

- PDI(ZWAS0040)

If the CBADMIN user account is not defined to the ACP, this is not a finding.

If the CBADMIN user account is defined to ACP and the password has NOT been changed from the vendor default of CBADMIN, this is a finding with a severity of Category I.

If the CBADMIN user account is defined to the ACP and the password has been changed from the vendor default of CBADMIN, this is a finding with a severity of Category II.

Vulnerability Number

V-224352

Documentable

False

Rule Version

ZWAS0040

Severity Override Guidance

Refer to the following report produced by the ACP Data Collection:

ACF2
- ACF2CMDS.RPT(LOGONIDS).
RACF
- RACFCMDS.RPT(LISTUSER).
TSS
- TSSCMDS.RPT(@ACIDS).

Automated Analysis requires Additional Analysis.
Refer to the following report produced by the z/OS Data Collection:

- PDI(ZWAS0040)

If the CBADMIN user account is not defined to the ACP, this is not a finding.

If the CBADMIN user account is defined to ACP and the password has NOT been changed from the vendor default of CBADMIN, this is a finding with a severity of Category I.

If the CBADMIN user account is defined to the ACP and the password has been changed from the vendor default of CBADMIN, this is a finding with a severity of Category II.

Check Content Reference

M

Target Key

4132