STIGQter: STIG Summary: IBM WebSphere Liberty Server Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Apr 2026:

Application security must be enabled on the WebSphere Liberty Server.

DISA Rule

SV-250341r1015252_rule

Vulnerability Number

V-250341

Group Title

SRG-APP-000315-AS-000094

Rule Version

IBMW-LS-000770

Severity

CAT I

CCI(s)

• CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.
• CCI-002314 - Employ automated mechanisms to control remote access methods.

Weight

10

Fix Recommendation

Configure the ${server.config.dir}/server.xml file and add the appSecurity-2.0 feature.

<featureManager>
<feature>appSecurity-2.0</feature>
</featureManager>

Review ${server.config.dir}/logs/messages.log

Validate log entry that indicates "Security service is ready".

Check Contents

As a user with local file access to ${server.config.dir}/server.xml file, verify application security is enabled.

If the appSecurity-2.0 feature is not defined within server.xml, this is a finding.

<featureManager>
<feature>appSecurity-2.0</feature>
</featureManager>

Vulnerability Number

V-250341

Documentable

False

Rule Version

IBMW-LS-000770

Severity Override Guidance

As a user with local file access to ${server.config.dir}/server.xml file, verify application security is enabled.

If the appSecurity-2.0 feature is not defined within server.xml, this is a finding.

<featureManager>
<feature>appSecurity-2.0</feature>
</featureManager>

Check Content Reference

M

Target Key

5424