STIGQter: STIG Summary: zOS WebSphere Application Server for TSS Security Technical Implementation Guide Version: 7 Release: 2 Benchmark Date: 01 Oct 2025:

Vendor-supplied user accounts for the WebSphere Application Server must be defined to the ACP.

DISA Rule

SV-225621r1146193_rule

Vulnerability Number

V-225621

Group Title

SRG-OS-000104

Rule Version

ZWAS0040

Severity

CAT I

CCI(s)

• CCI-001762 - Disable or remove organization-defined functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure.

Weight

10

Fix Recommendation

The ISSO will ensure that the CBADMIN user account is removed or not defined to the ACP.

Check Contents

Refer to the following reports produced by the ACP Data Collection:

ACF2
- ACF2CMDS.RPT(LOGONIDS).
RACF
- RACFCMDS.RPT(LISTUSER).
TSS
- TSSCMDS.RPT(@ACIDS).

Automated Analysis requires Additional Analysis.
Refer to the following report produced by the z/OS Data Collection:

- PDI(ZWAS0040).

If the CBADMIN user account is not defined to the ACP, this is not a finding.

If the CBADMIN user account is defined to ACP and the password has NOT been changed from the vendor default of CBADMIN, this is a finding with a severity of Category I.

If the CBADMIN user account is defined to the ACP and the password has been changed from the vendor default of CBADMIN, this is a finding with a severity of Category II.

Vulnerability Number

V-225621

Documentable

False

Rule Version

ZWAS0040

Severity Override Guidance

Refer to the following reports produced by the ACP Data Collection:

ACF2
- ACF2CMDS.RPT(LOGONIDS).
RACF
- RACFCMDS.RPT(LISTUSER).
TSS
- TSSCMDS.RPT(@ACIDS).

Automated Analysis requires Additional Analysis.
Refer to the following report produced by the z/OS Data Collection:

- PDI(ZWAS0040).

If the CBADMIN user account is not defined to the ACP, this is not a finding.

If the CBADMIN user account is defined to ACP and the password has NOT been changed from the vendor default of CBADMIN, this is a finding with a severity of Category I.

If the CBADMIN user account is defined to the ACP and the password has been changed from the vendor default of CBADMIN, this is a finding with a severity of Category II.

Check Content Reference

M

Target Key

4210