STIGQter: STIG Summary: IBM WebSphere Liberty Server Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Apr 2026:

Users in a reader-role must be authorized.

DISA Rule

SV-250342r961353_rule

Vulnerability Number

V-250342

Group Title

SRG-APP-000340-AS-000185

Rule Version

IBMW-LS-000790

Severity

CAT II

CCI(s)

• CCI-002235 - Prevent non-privileged users from executing privileged functions.

Weight

10

Fix Recommendation

Edit the ${server.config.dir}/server.xml file. If unauthorized users have been added to the reader-role, remove those users.

Otherwise, document the users who are granted the reader-role access.

To allow read-only access to select administrative REST APIs, the ${server.config.dir}/server.xml must be configured as follows. Additionally, the users and groups they are a part of must be defined within LDAP.

EXAMPLE:
<featureManager>
<feature>appSecurity-2.0</feature>
</featureManager>

<reader-role>
<group>group</group><group-access-id> group:realmName/groupUniqueId</group-access-id><user>user</user><user-access-id>user:realmName/userUniqueId</user-access-id>
</reader-role>

<ldapRegistry id="ldap" realm="SampleLdapRealm" host="${ldap.server.name}" port="${ldap.server.port}" ignoreCase="true"
baseDN="${ldap.server.base.dn}"
ldapType="${ldap.vendor.type}"
searchTimeout="8m">
</ldapRegistry>

Check Contents

As a user with access to the ${server.config.dir}/server.xml file. Review the contents and identify if users have been granted the reader-role.

grep -i reader-role ${server.config.dir}/server.xml

If the reader-role has been created, users in that role must be documented and approved.

If users in the reader-role are not approved, this is a finding.

EXAMPLE:
<featureManager><feature>appSecurity-2.0</feature></featureManager>

<reader-role>
<group>group</group>
<group-access-id>group:realmName/groupUniqueId</group-access-id>
<user>user</user>
<user-access-id>user:realmName/userUniqueId</user-access-id>
</reader-role>

Vulnerability Number

V-250342

Documentable

False

Rule Version

IBMW-LS-000790

Severity Override Guidance

As a user with access to the ${server.config.dir}/server.xml file. Review the contents and identify if users have been granted the reader-role.

grep -i reader-role ${server.config.dir}/server.xml

If the reader-role has been created, users in that role must be documented and approved.

If users in the reader-role are not approved, this is a finding.

EXAMPLE:
<featureManager><feature>appSecurity-2.0</feature></featureManager>

<reader-role>
<group>group</group>
<group-access-id>group:realmName/groupUniqueId</group-access-id>
<user>user</user>
<user-access-id>user:realmName/userUniqueId</user-access-id>
</reader-role>

Check Content Reference

M

Target Key

5424