{ "schema": "openvapt.catalogue/1", "name": "OpenVAPT Check Catalogue", "description": "All 310 read-only checks of OpenVAPT v0.1.0-alpha.6 with their severity, CVSS v3.1 vector, control category, standards mapping and source permalink. Generated from the code at build time.", "version": "0.1.0-alpha.6", "commit": "574f7f3333c44b75a3c649e2d93a76d507f75adf", "generated": "2026-10-16", "url": "https://openvapt.com/checks/catalogue.json", "homepage": "https://openvapt.com/checks/", "repository": "https://github.com/OpenVAPT/openvapt", "licence": "LicenseRef-OpenVAPT-SAL-1.3", "licence_url": "https://openvapt.com/legal/licence-text.html", "credit": "Data from OpenVAPT (openvapt.com), version 0.1.0-alpha.6, built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Credit is required when you copy or adapt it; see https://openvapt.com/cite.html.", "count": 310, "checks": [ { "id": "HOST-AUD-001", "title": "Audit Daemon Not Enabled at Boot", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "category": "Logging and Monitoring", "effort": "low", "summary": "Checks that the audit daemon (auditd) is set to start at every boot, not only running now.", "standards": { "cwe": [ "CWE-778" ], "owasp": [ "A09:2021" ], "nist": [ "AU-2", "AU-12" ], "cis_topic": "Audit daemon enabled at boot (CIS Controls v8 8.2)", "cis_v8": [ "8.2" ], "csf_2": [ "PR.PS-04" ] }, "cis_controls_v8": [ "8.2" ], "nist_csf_2": [ "PR.PS-04" ], "academy_modules": [ "P21" ], "page": "https://openvapt.com/checks/HOST-AUD-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/audit_journal.go", "source_file": "internal/checks/host/audit_journal.go" }, { "id": "HOST-AUD-002", "title": "Identity Files Not Audited", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "category": "Logging and Monitoring", "effort": "low", "summary": "Checks that changes to the account, group, password and sudo files are recorded by the audit system.", "standards": { "cwe": [ "CWE-778" ], "owasp": [ "A09:2021" ], "nist": [ "AU-2", "AU-12", "AC-2(4)" ], "cis_topic": "Audit changes to identity files (CIS Controls v8 8.5)", "cis_v8": [ "8.5" ], "csf_2": [ "PR.PS-04" ] }, "cis_controls_v8": [ "8.5" ], "nist_csf_2": [ "PR.PS-04" ], "academy_modules": [ "P21" ], "page": "https://openvapt.com/checks/HOST-AUD-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/audit_journal.go", "source_file": "internal/checks/host/audit_journal.go" }, { "id": "HOST-AUD-003", "title": "Login and Logout Events Not Audited", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "category": "Logging and Monitoring", "effort": "low", "summary": "Checks that the files recording logins, failed logins and sessions are watched by the audit system.", "standards": { "cwe": [ "CWE-778" ], "owasp": [ "A09:2021" ], "nist": [ "AU-2", "AU-12", "AC-7" ], "cis_topic": "Audit login, logout and session events (CIS Controls v8 8.5)", "cis_v8": [ "8.5" ], "csf_2": [ "PR.PS-04" ] }, "cis_controls_v8": [ "8.5" ], "nist_csf_2": [ "PR.PS-04" ], "academy_modules": [ "P21" ], "page": "https://openvapt.com/checks/HOST-AUD-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/audit_journal.go", "source_file": "internal/checks/host/audit_journal.go" }, { "id": "HOST-AUD-004", "title": "System Time Changes Not Audited", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "category": "Logging and Monitoring", "effort": "low", "summary": "Checks that the audit system records changes to the system clock and time zone.", "standards": { "cwe": [ "CWE-778" ], "owasp": [ "A09:2021" ], "nist": [ "AU-2", "AU-8", "AU-12" ], "cis_topic": "Audit date and time modification (CIS Controls v8 8.5)", "cis_v8": [ "8.5" ], "csf_2": [ "PR.PS-04" ] }, "cis_controls_v8": [ "8.5" ], "nist_csf_2": [ "PR.PS-04" ], "academy_modules": [ "P21" ], "page": "https://openvapt.com/checks/HOST-AUD-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/audit_journal.go", "source_file": "internal/checks/host/audit_journal.go" }, { "id": "HOST-AUD-005", "title": "Kernel Module Loading Not Audited", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "category": "Logging and Monitoring", "effort": "low", "summary": "Checks that loading and unloading kernel modules is recorded by the audit system.", "standards": { "cwe": [ "CWE-778" ], "owasp": [ "A09:2021" ], "nist": [ "AU-2", "AU-12", "CM-7" ], "cis_topic": "Audit kernel module loading and unloading (CIS Controls v8 8.5)", "cis_v8": [ "8.5" ], "csf_2": [ "PR.PS-04" ] }, "cis_controls_v8": [ "8.5" ], "nist_csf_2": [ "PR.PS-04" ], "academy_modules": [ "P21" ], "page": "https://openvapt.com/checks/HOST-AUD-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/audit_journal.go", "source_file": "internal/checks/host/audit_journal.go" }, { "id": "HOST-AUD-006", "title": "Privileged Command Use Not Audited", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "category": "Logging and Monitoring", "effort": "low", "summary": "Checks that the audit system records when ordinary users run privileged (setuid or setgid) programs.", "standards": { "cwe": [ "CWE-778" ], "owasp": [ "A09:2021" ], "nist": [ "AU-2", "AU-12", "AC-6(9)" ], "cis_topic": "Audit use of privileged commands (CIS Controls v8 8.5)", "cis_v8": [ "8.5" ], "csf_2": [ "PR.PS-04" ] }, "cis_controls_v8": [ "8.5" ], "nist_csf_2": [ "PR.PS-04" ], "academy_modules": [ "P21" ], "page": "https://openvapt.com/checks/HOST-AUD-006.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/audit_journal.go", "source_file": "internal/checks/host/audit_journal.go" }, { "id": "HOST-AUD-007", "title": "Audit Configuration Not Immutable", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "category": "Logging and Monitoring", "effort": "low", "summary": "Checks that the audit rule set ends with -e 2, which locks the rules until the next reboot.", "standards": { "cwe": [ "CWE-778" ], "owasp": [ "A09:2021" ], "nist": [ "AU-9", "AU-12" ], "cis_topic": "Audit configuration is immutable (CIS Controls v8 8.2)", "cis_v8": [ "8.2" ], "csf_2": [ "PR.PS-04" ] }, "cis_controls_v8": [ "8.2" ], "nist_csf_2": [ "PR.PS-04" ], "academy_modules": [ "P21" ], "page": "https://openvapt.com/checks/HOST-AUD-007.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/audit_journal.go", "source_file": "internal/checks/host/audit_journal.go" }, { "id": "HOST-AUD-008", "title": "Audit Log Files Readable by Others", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Logging and Monitoring", "effort": "low", "summary": "Checks that the audit log directory and files can be read only by root.", "standards": { "cwe": [ "CWE-532", "CWE-732" ], "owasp": [ "A09:2021" ], "nist": [ "AU-9", "AC-6" ], "cis_topic": "Audit log files and directory are protected (CIS Controls v8 8.2)", "cis_v8": [ "8.2" ], "csf_2": [ "PR.PS-04" ] }, "cis_controls_v8": [ "8.2" ], "nist_csf_2": [ "PR.PS-04" ], "academy_modules": [ "P21" ], "page": "https://openvapt.com/checks/HOST-AUD-008.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/audit_journal.go", "source_file": "internal/checks/host/audit_journal.go" }, { "id": "HOST-AUD-009", "title": "Audit Daemon Ignores a Full Log Disk", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "category": "Logging and Monitoring", "effort": "low", "summary": "Checks that auditd is told what to do when its log file is full or the disk runs low, rather than silently dropping events.", "standards": { "cwe": [ "CWE-778" ], "owasp": [ "A09:2021" ], "nist": [ "AU-4", "AU-5" ], "cis_topic": "Audit log storage and full-disk actions (CIS Controls v8 8.3)", "cis_v8": [ "8.3" ], "csf_2": [ "PR.PS-04" ] }, "cis_controls_v8": [ "8.3" ], "nist_csf_2": [ "PR.PS-04" ], "academy_modules": [ "P21" ], "page": "https://openvapt.com/checks/HOST-AUD-009.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/audit_journal.go", "source_file": "internal/checks/host/audit_journal.go" }, { "id": "HOST-AUD-010", "title": "Journal Not Persistent or Not Compressed", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "category": "Logging and Monitoring", "effort": "low", "summary": "Checks that systemd-journald is configured to keep the journal on disk and to compress it.", "standards": { "cwe": [ "CWE-778" ], "owasp": [ "A09:2021" ], "nist": [ "AU-4", "AU-9", "AU-11" ], "cis_topic": "journald persistent storage and compression (CIS Controls v8 8.3)", "cis_v8": [ "8.3" ], "csf_2": [ "PR.PS-04" ] }, "cis_controls_v8": [ "8.3" ], "nist_csf_2": [ "PR.PS-04" ], "academy_modules": [ "P21" ], "page": "https://openvapt.com/checks/HOST-AUD-010.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/audit_journal.go", "source_file": "internal/checks/host/audit_journal.go" }, { "id": "HOST-AUD-011", "title": "Logs Not Forwarded to a Remote Collector", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "category": "Logging and Monitoring", "effort": "medium", "summary": "Checks that system logs are sent to another machine, so an intruder with root cannot erase the only copy.", "standards": { "cwe": [ "CWE-778" ], "owasp": [ "A09:2021" ], "nist": [ "AU-9(2)", "AU-6", "SI-4" ], "cis_topic": "Centralised log collection (CIS Controls v8 8.9)", "cis_v8": [ "8.9" ], "csf_2": [ "PR.PS-04", "DE.CM-09" ] }, "cis_controls_v8": [ "8.9" ], "nist_csf_2": [ "PR.PS-04", "DE.CM-09" ], "academy_modules": [ "P21" ], "page": "https://openvapt.com/checks/HOST-AUD-011.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/audit_journal.go", "source_file": "internal/checks/host/audit_journal.go" }, { "id": "HOST-BOOT-001", "title": "Boot Loader Has No Password", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Access Control", "effort": "medium", "summary": "Checks that GRUB is configured with a superuser and a hashed password so the boot entries cannot be edited at the console.", "standards": { "cwe": [ "CWE-306" ], "nist": [ "AC-3", "AC-6", "CM-6" ], "cis_topic": "Boot loader password (CIS Controls v8 4.1)", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P17" ], "page": "https://openvapt.com/checks/HOST-BOOT-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/boot.go", "source_file": "internal/checks/host/boot.go" }, { "id": "HOST-BOOT-002", "title": "UEFI Secure Boot Disabled", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Secure Configuration", "effort": "high", "summary": "Checks the firmware's SecureBoot variable to see whether the boot chain is verified.", "standards": { "cwe": [ "CWE-1326" ], "nist": [ "SI-7", "CM-6" ], "cis_topic": "Boot integrity (CIS Controls v8 4.1)", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P17" ], "page": "https://openvapt.com/checks/HOST-BOOT-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/boot.go", "source_file": "internal/checks/host/boot.go" }, { "id": "HOST-BOOT-003", "title": "Uncommon Filesystem Modules Not Disabled", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "category": "Secure Configuration", "effort": "low", "summary": "Checks that the cramfs, freevxfs, jffs2, hfs, hfsplus, udf and squashfs kernel modules are disabled in modprobe.d.", "standards": { "cwe": [ "CWE-1188" ], "nist": [ "CM-7", "CM-6" ], "cis_topic": "Disable unused filesystem kernel modules (CIS Controls v8 4.8)", "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P17" ], "page": "https://openvapt.com/checks/HOST-BOOT-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/boot.go", "source_file": "internal/checks/host/boot.go" }, { "id": "HOST-BOOT-004", "title": "USB Storage Driver Not Disabled", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that the usb-storage kernel module is disabled in modprobe.d on servers that do not need removable media.", "standards": { "cwe": [ "CWE-1188" ], "nist": [ "MP-7", "CM-7" ], "cis_topic": "Disable USB storage (CIS Controls v8 4.8)", "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P17" ], "page": "https://openvapt.com/checks/HOST-BOOT-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/boot.go", "source_file": "internal/checks/host/boot.go" }, { "id": "HOST-BOOT-005", "title": "Kernel Module Loading Unrestricted", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L", "category": "Secure Configuration", "effort": "medium", "summary": "Checks that the running kernel refuses unsigned modules or has module loading switched off entirely.", "standards": { "cwe": [ "CWE-1188" ], "nist": [ "SI-7", "CM-7" ], "cis_topic": "Restrict kernel module loading (CIS Controls v8 4.8)", "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P17" ], "page": "https://openvapt.com/checks/HOST-BOOT-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/boot.go", "source_file": "internal/checks/host/boot.go" }, { "id": "HOST-BOOT-006", "title": "No File Integrity Monitoring", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N", "category": "Logging and Monitoring", "effort": "medium", "summary": "Checks that a file integrity tool (AIDE, Tripwire, Samhain or equivalent) is installed and scheduled to run.", "standards": { "cwe": [ "CWE-778" ], "nist": [ "SI-7", "CM-3" ], "cis_topic": "File integrity checking (CIS Controls v8 4.1)", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P17" ], "page": "https://openvapt.com/checks/HOST-BOOT-006.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/boot.go", "source_file": "internal/checks/host/boot.go" }, { "id": "HOST-BOOT-007", "title": "Prelink Installed", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that the prelink tool is absent, or disabled where the package is still installed.", "standards": { "cwe": [ "CWE-344" ], "nist": [ "SI-7", "CM-7" ], "cis_topic": "Prelink not installed (CIS Controls v8 4.8)", "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P17" ], "page": "https://openvapt.com/checks/HOST-BOOT-007.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/boot.go", "source_file": "internal/checks/host/boot.go" }, { "id": "HOST-BOOT-008", "title": "Core Dumps Not Restricted", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks that process core dumps are turned off through PAM limits, and through systemd-coredump where the kernel hands dumps to it.", "standards": { "cwe": [ "CWE-528" ], "nist": [ "SI-11", "CM-6", "AC-6" ], "cis_topic": "Restrict core dumps (CIS Controls v8 4.1)", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P17" ], "page": "https://openvapt.com/checks/HOST-BOOT-008.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/boot.go", "source_file": "internal/checks/host/boot.go" }, { "id": "HOST-CRON-001", "title": "Cron Jobs Run Programs Other Users Can Modify", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "category": "Access Control", "effort": "low", "summary": "Resolves the programs and scripts that system and root cron jobs run and checks whether any is world-writable or sits in a world-writable folder.", "standards": { "cwe": [ "CWE-732", "CWE-426" ], "nist": [ "AC-3", "AC-6", "CM-5" ], "cis_topic": "Job schedulers: cron permissions", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P20" ], "page": "https://openvapt.com/checks/HOST-CRON-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hygiene.go", "source_file": "internal/checks/host/hygiene.go" }, { "id": "HOST-CRON-002", "title": "World-Writable Directory in Cron's PATH", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "category": "Access Control", "effort": "low", "summary": "Checks the PATH that system cron jobs search for commands for world-writable or relative entries.", "standards": { "cwe": [ "CWE-426", "CWE-427" ], "nist": [ "CM-6", "AC-6", "CM-7" ], "cis_topic": "Root PATH integrity", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P20" ], "page": "https://openvapt.com/checks/HOST-CRON-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hygiene.go", "source_file": "internal/checks/host/hygiene.go" }, { "id": "HOST-CTR-001", "title": "Docker API Exposed Over TCP Without TLS", "domain": "host", "severity": "critical", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "category": "Network Exposure", "effort": "low", "summary": "Checks whether the Docker daemon is configured to listen on a TCP socket without TLS client verification.", "standards": { "cwe": [ "CWE-306", "CWE-319" ], "owasp": [ "A05:2021", "A07:2021" ], "nist": [ "AC-3", "SC-8" ], "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P9" ], "page": "https://openvapt.com/checks/HOST-CTR-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/containers.go", "source_file": "internal/checks/host/containers.go" }, { "id": "HOST-CTR-002", "title": "Docker Daemon Not Hardened", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L", "category": "Secure Configuration", "effort": "medium", "summary": "Checks the Docker daemon defaults: no-new-privileges, inter-container communication, user namespace remapping and live restore.", "standards": { "cwe": [ "CWE-250", "CWE-1188" ], "nist": [ "CM-6", "AC-6" ], "cis_topic": "Docker daemon configuration", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P9" ], "page": "https://openvapt.com/checks/HOST-CTR-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/containers.go", "source_file": "internal/checks/host/containers.go" }, { "id": "HOST-CTR-003", "title": "Privileged or Host-Namespace Containers", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "category": "Secure Configuration", "effort": "medium", "summary": "Looks for containers running privileged, sharing the host's PID, network or IPC namespace, or with dangerous added capabilities.", "standards": { "cwe": [ "CWE-250", "CWE-653" ], "nist": [ "AC-6", "SC-39" ], "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P9" ], "page": "https://openvapt.com/checks/HOST-CTR-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/containers.go", "source_file": "internal/checks/host/containers.go" }, { "id": "HOST-CTR-004", "title": "Containers Mount the Docker Socket or Host Root", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "category": "Access Control", "effort": "medium", "summary": "Looks for containers that bind-mount the Docker socket, the host root filesystem or sensitive host paths.", "standards": { "cwe": [ "CWE-250", "CWE-732" ], "nist": [ "AC-6", "SC-39" ], "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P9" ], "page": "https://openvapt.com/checks/HOST-CTR-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/containers.go", "source_file": "internal/checks/host/containers.go" }, { "id": "HOST-CTR-005", "title": "Docker Container Logs Have No Size Limit", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "category": "Logging and Monitoring", "effort": "low", "summary": "Checks whether the Docker daemon's default log driver caps log file size and rotation.", "standards": { "cwe": [ "CWE-779", "CWE-770" ], "nist": [ "AU-4", "SC-5", "CM-6" ], "cis_topic": "CIS Docker Benchmark 2.12 (centralised and bounded container logging)", "cis_v8": [ "8.3" ], "csf_2": [ "PR.PS-04" ] }, "cis_controls_v8": [ "8.3" ], "nist_csf_2": [ "PR.PS-04" ], "academy_modules": [ "P9", "A5" ], "page": "https://openvapt.com/checks/HOST-CTR-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/containers_depth.go", "source_file": "internal/checks/host/containers_depth.go" }, { "id": "HOST-CTR-006", "title": "Docker Userland Proxy Enabled", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "category": "Secure Configuration", "effort": "low", "summary": "Checks whether the Docker daemon still uses the docker-proxy userland process for published ports.", "standards": { "cwe": [ "CWE-1188" ], "nist": [ "CM-7", "CM-6" ], "cis_topic": "CIS Docker Benchmark 2.14 (disable the userland proxy)", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P9", "A5" ], "page": "https://openvapt.com/checks/HOST-CTR-006.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/containers_depth.go", "source_file": "internal/checks/host/containers_depth.go" }, { "id": "HOST-CTR-007", "title": "Docker Default Ulimits Not Set", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "category": "Secure Configuration", "effort": "low", "summary": "Checks whether the Docker daemon sets default ulimits (open files and processes) for containers.", "standards": { "cwe": [ "CWE-770" ], "nist": [ "SC-6", "CM-6" ], "cis_topic": "CIS Docker Benchmark 2.7 (default ulimit)", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P9", "A5" ], "page": "https://openvapt.com/checks/HOST-CTR-007.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/containers_depth.go", "source_file": "internal/checks/host/containers_depth.go" }, { "id": "HOST-CTR-008", "title": "Docker Socket Accessible to Non-Administrators", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "category": "Access Control", "effort": "low", "summary": "Checks the Docker socket's permissions and who belongs to the docker group.", "standards": { "cwe": [ "CWE-732", "CWE-250" ], "nist": [ "AC-3", "AC-6", "CM-6" ], "cis_topic": "CIS Docker Benchmark 1.2.2 and 3.15 (only trusted users control the daemon; socket ownership and permissions)", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P9", "A5" ], "page": "https://openvapt.com/checks/HOST-CTR-008.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/containers_depth.go", "source_file": "internal/checks/host/containers_depth.go" }, { "id": "HOST-CTR-009", "title": "Docker Not Running in Rootless Mode", "domain": "host", "severity": "info", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N", "category": "Secure Configuration", "effort": "high", "summary": "Reports whether the Docker daemon runs as root or in rootless mode. Informational.", "standards": { "cwe": [ "CWE-250" ], "nist": [ "AC-6", "SC-39" ], "cis_topic": "CIS Docker Benchmark 2.18 (run the daemon in rootless mode)", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P9", "A5" ], "page": "https://openvapt.com/checks/HOST-CTR-009.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/containers_depth.go", "source_file": "internal/checks/host/containers_depth.go" }, { "id": "HOST-CTR-010", "title": "Docker Daemon Allows Insecure Registries or Debug Features", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks daemon.json for insecure-registries, debug mode and experimental features.", "standards": { "cwe": [ "CWE-494", "CWE-1188" ], "nist": [ "SI-7", "CM-7" ], "cis_topic": "CIS Docker Benchmark 2.4 and 2.10 (no insecure registries; no experimental features)", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P9", "A5" ], "page": "https://openvapt.com/checks/HOST-CTR-010.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/containers_depth.go", "source_file": "internal/checks/host/containers_depth.go" }, { "id": "HOST-CTR-011", "title": "Seccomp or AppArmor Disabled for Containers", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "category": "Secure Configuration", "effort": "medium", "summary": "Looks for the daemon or individual containers turning off the default seccomp profile, AppArmor or SELinux labelling.", "standards": { "cwe": [ "CWE-653", "CWE-250" ], "nist": [ "AC-6", "SC-39", "CM-7" ], "cis_topic": "CIS Docker Benchmark 5.1 and 5.22 (AppArmor profile; seccomp not unconfined)", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P9", "A5" ], "page": "https://openvapt.com/checks/HOST-CTR-011.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/containers_depth.go", "source_file": "internal/checks/host/containers_depth.go" }, { "id": "HOST-CTR-012", "title": "Containers Run Without Memory or Process Limits", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "category": "Secure Configuration", "effort": "medium", "summary": "Looks for containers with no memory limit and no PID limit.", "standards": { "cwe": [ "CWE-770" ], "nist": [ "SC-6", "SC-5" ], "cis_topic": "CIS Docker Benchmark 5.11 and 5.29 (memory limit; PIDs cgroup limit)", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P9", "A5" ], "page": "https://openvapt.com/checks/HOST-CTR-012.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/containers_depth.go", "source_file": "internal/checks/host/containers_depth.go" }, { "id": "HOST-CTR-013", "title": "Containers Run as Root With a Writable Root Filesystem", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "category": "Secure Configuration", "effort": "medium", "summary": "Looks for containers whose process runs as root and whose root filesystem is writable.", "standards": { "cwe": [ "CWE-250", "CWE-732" ], "nist": [ "AC-6", "CM-7" ], "cis_topic": "CIS Docker Benchmark 4.1 and 5.13 (non-root user; read-only root filesystem)", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P9", "A5" ], "page": "https://openvapt.com/checks/HOST-CTR-013.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/containers_depth.go", "source_file": "internal/checks/host/containers_depth.go" }, { "id": "HOST-CTR-014", "title": "containerd Remote API or Podman Unconfined Defaults", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Secure Configuration", "effort": "medium", "summary": "Checks the containerd and Podman configuration files for a TCP API without TLS and for unconfined seccomp or disabled labelling defaults.", "standards": { "cwe": [ "CWE-306", "CWE-1188" ], "nist": [ "AC-3", "SC-8", "CM-6" ], "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P9", "A5" ], "page": "https://openvapt.com/checks/HOST-CTR-014.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/containers_depth.go", "source_file": "internal/checks/host/containers_depth.go" }, { "id": "HOST-CTR-015", "title": "Docker Content Trust Not Enabled", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "category": "Secure Configuration", "effort": "medium", "summary": "Checks whether DOCKER_CONTENT_TRUST=1 is set system-wide so that only signed images are pulled.", "standards": { "cwe": [ "CWE-494", "CWE-347" ], "nist": [ "SI-7", "CM-14" ], "cis_topic": "CIS Docker Benchmark 4.5 (enable content trust)", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P9", "A5" ], "page": "https://openvapt.com/checks/HOST-CTR-015.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/containers_depth.go", "source_file": "internal/checks/host/containers_depth.go" }, { "id": "HOST-CVE-001", "title": "Installed OS Packages With Known Vulnerabilities", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Patch and Vulnerability Management", "effort": "medium", "summary": "Checks installed packages against an offline vulnerability snapshot.", "standards": { "cwe": [ "CWE-1104" ], "owasp": [ "A06:2021" ], "nist": [ "SI-2", "RA-5" ], "cis_v8": [ "7.3" ], "csf_2": [ "ID.RA-01", "PR.PS-02" ] }, "cis_controls_v8": [ "7.3" ], "nist_csf_2": [ "ID.RA-01", "PR.PS-02" ], "academy_modules": [ "P10" ], "page": "https://openvapt.com/checks/HOST-CVE-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/cve.go", "source_file": "internal/checks/host/cve.go" }, { "id": "HOST-CVE-002", "title": "Known Exploited Vulnerabilities Present", "domain": "host", "severity": "critical", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Patch and Vulnerability Management", "effort": "medium", "summary": "Checks installed packages against an offline vulnerability snapshot.", "standards": { "cwe": [ "CWE-1104" ], "owasp": [ "A06:2021" ], "nist": [ "SI-2", "RA-5" ], "cis_v8": [ "7.3" ], "csf_2": [ "ID.RA-01", "PR.PS-02" ] }, "cis_controls_v8": [ "7.3" ], "nist_csf_2": [ "ID.RA-01", "PR.PS-02" ], "academy_modules": [ "P10" ], "page": "https://openvapt.com/checks/HOST-CVE-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/cve.go", "source_file": "internal/checks/host/cve.go" }, { "id": "HOST-CVE-003", "title": "Vulnerability Snapshot Outdated or Test Data", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Patch and Vulnerability Management", "effort": "medium", "summary": "Checks installed packages against an offline vulnerability snapshot.", "standards": { "cwe": [ "CWE-1104" ], "owasp": [ "A06:2021" ], "nist": [ "SI-2", "RA-5" ], "cis_v8": [ "7.3" ], "csf_2": [ "ID.RA-01", "PR.PS-02" ] }, "cis_controls_v8": [ "7.3" ], "nist_csf_2": [ "ID.RA-01", "PR.PS-02" ], "academy_modules": [ "P10" ], "page": "https://openvapt.com/checks/HOST-CVE-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/cve.go", "source_file": "internal/checks/host/cve.go" }, { "id": "HOST-DKR-001", "title": "Users With Root-Equivalent Docker Access", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "category": "Identity and Authentication", "effort": "medium", "summary": "Checks whether non-root users can control Docker, which is equivalent to root access.", "standards": { "cwe": [ "CWE-250", "CWE-266" ], "nist": [ "AC-6" ], "cis_v8": [ "5.4" ], "csf_2": [ "PR.AA-05" ] }, "cis_controls_v8": [ "5.4" ], "nist_csf_2": [ "PR.AA-05" ], "academy_modules": [ "P7", "P9" ], "page": "https://openvapt.com/checks/HOST-DKR-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hardening.go", "source_file": "internal/checks/host/hardening.go" }, { "id": "HOST-FS-001", "title": "Sensitive Account Files Have Unsafe Permissions", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "category": "Access Control", "effort": "low", "summary": "Checks that /etc/shadow and /etc/gshadow are not readable by others, and /etc/passwd and /etc/group are not writable by others.", "standards": { "cwe": [ "CWE-732" ], "nist": [ "AC-3", "AC-6" ], "cis_topic": "File permissions: account database files", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P1", "P15" ], "page": "https://openvapt.com/checks/HOST-FS-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/files.go", "source_file": "internal/checks/host/files.go" }, { "id": "HOST-FS-002", "title": "Temporary Directory Missing the Sticky Bit", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "category": "Access Control", "effort": "low", "summary": "Checks that world-writable temp directories have the sticky bit set.", "standards": { "cwe": [ "CWE-377", "CWE-732" ], "nist": [ "AC-3" ], "cis_topic": "Filesystem: sticky bit on world-writable directories", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-FS-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/files.go", "source_file": "internal/checks/host/files.go" }, { "id": "HOST-FS-003", "title": "World-Writable Files in System Configuration", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "category": "Access Control", "effort": "medium", "summary": "Looks for files under /etc and in cron directories that any user can modify.", "standards": { "cwe": [ "CWE-732" ], "nist": [ "AC-3", "CM-6" ], "cis_topic": "File permissions: no world-writable files", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-FS-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/files.go", "source_file": "internal/checks/host/files.go" }, { "id": "HOST-FS-004", "title": "Unexpected SUID or SGID Programs", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "category": "Access Control", "effort": "medium", "summary": "Looks for set-user-ID or set-group-ID programs in places where packages do not normally install them.", "standards": { "cwe": [ "CWE-250" ], "nist": [ "CM-7", "AC-6" ], "cis_topic": "Filesystem: audit SUID and SGID executables", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-FS-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/files.go", "source_file": "internal/checks/host/files.go" }, { "id": "HOST-FS-005", "title": "Cron Files Writable by Non-Root Users", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "category": "Access Control", "effort": "low", "summary": "Checks that system cron files and directories are owned by root and not writable by others.", "standards": { "cwe": [ "CWE-732" ], "nist": [ "AC-3", "CM-6" ], "cis_topic": "Job schedulers: cron permissions", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-FS-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/files.go", "source_file": "internal/checks/host/files.go" }, { "id": "HOST-FS-006", "title": "Boot Loader Configuration Exposed", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "category": "Access Control", "effort": "low", "summary": "Checks that the GRUB configuration is not readable or writable by normal users.", "standards": { "cwe": [ "CWE-732" ], "nist": [ "AC-3", "AC-6" ], "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-FS-006.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hardening.go", "source_file": "internal/checks/host/hardening.go" }, { "id": "HOST-FS-007", "title": "Private TLS Keys Readable by Others", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "category": "Cryptography and TLS", "effort": "low", "summary": "Checks that TLS private keys under the standard key directories are not readable by other users.", "standards": { "cwe": [ "CWE-732" ], "nist": [ "AC-3", "AC-6" ], "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-FS-007.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hardening.go", "source_file": "internal/checks/host/hardening.go" }, { "id": "HOST-FS-008", "title": "Temporary Filesystems Allow Executables or Devices", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "medium", "summary": "Checks that /tmp, /var/tmp and /dev/shm are mounted with nodev and nosuid.", "standards": { "cwe": [ "CWE-276" ], "nist": [ "CM-6", "CM-7" ], "cis_topic": "Separate partitions and mount options for temporary directories", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-FS-008.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hardening.go", "source_file": "internal/checks/host/hardening.go" }, { "id": "HOST-FS-009", "title": "Default File Creation Mask Too Permissive", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Access Control", "effort": "low", "summary": "Checks that the default umask makes new files unreadable to other users (027 or stricter).", "standards": { "cwe": [ "CWE-276" ], "nist": [ "AC-6", "CM-6" ], "cis_topic": "Default user umask", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P1", "P15" ], "page": "https://openvapt.com/checks/HOST-FS-009.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hardening.go", "source_file": "internal/checks/host/hardening.go" }, { "id": "HOST-FS-010", "title": "/var/tmp Not a Separate Filesystem", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "category": "Secure Configuration", "effort": "medium", "summary": "Checks that /var/tmp is its own mount (or a bind mount of /tmp) with nodev, nosuid and noexec.", "standards": { "cwe": [ "CWE-276" ], "nist": [ "CM-6", "CM-7", "SC-5" ], "cis_topic": "Separate partitions and mount options (CIS Controls v8 4.1)", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-FS-010.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/files_mounts.go", "source_file": "internal/checks/host/files_mounts.go" }, { "id": "HOST-FS-011", "title": "/home Not a Separate Filesystem With nodev", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "category": "Secure Configuration", "effort": "medium", "summary": "Checks that user home directories live on their own mount with nodev (and nosuid where practical).", "standards": { "cwe": [ "CWE-276" ], "nist": [ "CM-6", "CM-7", "SC-5" ], "cis_topic": "Separate partitions and mount options (CIS Controls v8 4.1)", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-FS-011.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/files_mounts.go", "source_file": "internal/checks/host/files_mounts.go" }, { "id": "HOST-FS-012", "title": "Log Directories on the Root Filesystem", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "category": "Secure Configuration", "effort": "medium", "summary": "Checks that /var/log (or /var) is a separate filesystem so runaway logging cannot fill the root disk.", "standards": { "cwe": [ "CWE-770" ], "nist": [ "CM-6", "CM-7", "SC-5" ], "cis_topic": "Separate partitions and mount options (CIS Controls v8 4.1)", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-FS-012.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/files_mounts.go", "source_file": "internal/checks/host/files_mounts.go" }, { "id": "HOST-FS-013", "title": "Temporary Filesystems Allow Executables", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "category": "Secure Configuration", "effort": "medium", "summary": "Checks that /tmp, /var/tmp and /dev/shm, where they are separate mounts, carry the noexec option.", "standards": { "cwe": [ "CWE-276" ], "nist": [ "CM-6", "CM-7" ], "cis_topic": "noexec on temporary filesystems (CIS Controls v8 4.1)", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-FS-013.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/files_mounts.go", "source_file": "internal/checks/host/files_mounts.go" }, { "id": "HOST-FS-014", "title": "World-Writable Files Outside Temporary Directories", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "category": "Access Control", "effort": "low", "summary": "Looks for files that any user can modify in program, service and home locations other than /etc (which HOST-FS-003 covers).", "standards": { "cwe": [ "CWE-732" ], "nist": [ "AC-3", "AC-6", "CM-6" ], "cis_topic": "No world-writable files (CIS Controls v8 3.3)", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-FS-014.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/files_mounts.go", "source_file": "internal/checks/host/files_mounts.go" }, { "id": "HOST-FS-015", "title": "Files With No Known Owner or Group", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "category": "Access Control", "effort": "low", "summary": "Looks for files whose owner or group id no longer appears in /etc/passwd or /etc/group.", "standards": { "cwe": [ "CWE-282" ], "nist": [ "AC-2", "AC-6", "CM-6" ], "cis_topic": "No unowned or ungrouped files (CIS Controls v8 3.3)", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-FS-015.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/files_mounts.go", "source_file": "internal/checks/host/files_mounts.go" }, { "id": "HOST-FS-016", "title": "SUID or SGID Programs Outside the Known Baseline", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "category": "Access Control", "effort": "medium", "summary": "Lists set-user-ID and set-group-ID programs in the system binary directories that are not on the documented baseline of what distributions ship.", "standards": { "cwe": [ "CWE-250" ], "nist": [ "AC-6", "CM-7" ], "cis_topic": "Audit SUID and SGID executables (CIS Controls v8 4.1)", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-FS-016.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/files_mounts.go", "source_file": "internal/checks/host/files_mounts.go" }, { "id": "HOST-FS-017", "title": "World-Writable Directories Without the Sticky Bit", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "category": "Access Control", "effort": "low", "summary": "Looks for shared writable directories outside /tmp and /etc that let any user delete or replace other users' files.", "standards": { "cwe": [ "CWE-732", "CWE-377" ], "nist": [ "AC-3", "CM-6" ], "cis_topic": "Sticky bit on world-writable directories (CIS Controls v8 3.3)", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-FS-017.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/files_mounts.go", "source_file": "internal/checks/host/files_mounts.go" }, { "id": "HOST-FS-018", "title": "Kernel Symbol Map or Initial RAM Disk Readable by Others", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks that /boot/System.map-* and the initial RAM disk images are not readable by every user.", "standards": { "cwe": [ "CWE-497", "CWE-732" ], "nist": [ "AC-3", "AC-6" ], "cis_topic": "Boot file permissions (CIS Controls v8 3.3)", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-FS-018.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/files_mounts.go", "source_file": "internal/checks/host/files_mounts.go" }, { "id": "HOST-FS-019", "title": "Cron and At Not Restricted to Allowed Users", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "category": "Access Control", "effort": "low", "summary": "Checks that cron.allow and at.allow exist, are private to root, and that the deny lists are not relied upon instead.", "standards": { "cwe": [ "CWE-862" ], "nist": [ "AC-6", "CM-7" ], "cis_topic": "Restrict cron and at to authorised users (CIS Controls v8 4.1)", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-FS-019.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/files_mounts.go", "source_file": "internal/checks/host/files_mounts.go" }, { "id": "HOST-FS-020", "title": "Cron Configuration Readable by Other Users", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Access Control", "effort": "low", "summary": "Checks that /etc/crontab is mode 600 and the cron.d, cron.hourly, cron.daily, cron.weekly and cron.monthly directories are mode 700, all owned by root.", "standards": { "cwe": [ "CWE-732" ], "nist": [ "AC-3", "AC-6" ], "cis_topic": "Cron file permissions (CIS Controls v8 3.3)", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-FS-020.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/files_mounts.go", "source_file": "internal/checks/host/files_mounts.go" }, { "id": "HOST-FS-021", "title": "Shell Profile Sets a Permissive File Creation Mask", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Access Control", "effort": "low", "summary": "Checks that system-wide shell start-up files do not set a umask that leaves new files readable by every user.", "standards": { "cwe": [ "CWE-276" ], "nist": [ "AC-6", "CM-6" ], "cis_topic": "Default user umask in shell start-up files (CIS Controls v8 3.3)", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-FS-021.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/files_mounts.go", "source_file": "internal/checks/host/files_mounts.go" }, { "id": "HOST-FS-022", "title": "Account Database Files or Their Backups Not Owned and Locked by Root", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "category": "Access Control", "effort": "low", "summary": "Checks the owner and permissions of /etc/passwd, /etc/group, /etc/shadow, /etc/gshadow and their dash-suffixed backup copies.", "standards": { "cwe": [ "CWE-732", "CWE-522" ], "nist": [ "AC-3", "AC-6", "IA-5" ], "cis_topic": "Account database file ownership and permissions (CIS Controls v8 3.3)", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-FS-022.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/files_mounts.go", "source_file": "internal/checks/host/files_mounts.go" }, { "id": "HOST-IDS-001", "title": "No Brute-Force Protection Service", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Logging and Monitoring", "effort": "low", "summary": "Checks that a log-based intrusion prevention service (fail2ban, sshguard or CrowdSec) is running.", "standards": { "cwe": [ "CWE-307" ], "owasp": [ "A07:2021" ], "nist": [ "SI-4", "AC-7" ], "cis_v8": [ "8.2" ], "csf_2": [ "PR.PS-04" ] }, "cis_controls_v8": [ "8.2" ], "nist_csf_2": [ "PR.PS-04" ], "academy_modules": [ "P16" ], "page": "https://openvapt.com/checks/HOST-IDS-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hardening.go", "source_file": "internal/checks/host/hardening.go" }, { "id": "HOST-K8S-001", "title": "Kubelet Allows Anonymous or Unauthorised Access", "domain": "host", "severity": "critical", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "category": "Identity and Authentication", "effort": "medium", "summary": "Checks the kubelet configuration for anonymous authentication, AlwaysAllow authorisation or the unauthenticated read-only port.", "standards": { "cwe": [ "CWE-306", "CWE-862" ], "owasp": [ "A01:2021", "A07:2021" ], "nist": [ "AC-3", "IA-2" ], "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P9" ], "page": "https://openvapt.com/checks/HOST-K8S-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/containers.go", "source_file": "internal/checks/host/containers.go" }, { "id": "HOST-K8S-002", "title": "Kubernetes Data Directory Accessible to Others", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "category": "Access Control", "effort": "low", "summary": "Checks that the etcd data directory is accessible only by its owner.", "standards": { "cwe": [ "CWE-732" ], "nist": [ "AC-3", "SC-28" ], "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P9" ], "page": "https://openvapt.com/checks/HOST-K8S-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/containers.go", "source_file": "internal/checks/host/containers.go" }, { "id": "HOST-K8S-003", "title": "Kubernetes Credential Files Readable by Others", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "category": "Identity and Authentication", "effort": "low", "summary": "Checks that kubeconfig files and Kubernetes PKI private keys are not readable by other users.", "standards": { "cwe": [ "CWE-732" ], "nist": [ "AC-3", "AC-6" ], "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P9" ], "page": "https://openvapt.com/checks/HOST-K8S-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hardening.go", "source_file": "internal/checks/host/hardening.go" }, { "id": "HOST-KRN-001", "title": "Address Space Layout Randomisation Not Fully Enabled", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that the kernel randomises memory layout for stack, libraries, heap and VDSO.", "standards": { "cwe": [ "CWE-344" ], "nist": [ "CM-6", "SI-16" ], "cis_topic": "Kernel parameters: kernel.randomize_va_space", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-KRN-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-002", "title": "Kernel Pointers Exposed to Unprivileged Users", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that kernel memory addresses are hidden from normal users.", "standards": { "cwe": [ "CWE-497" ], "nist": [ "CM-6", "SI-16" ], "cis_topic": "Kernel parameters: kernel.kptr_restrict", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-KRN-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-003", "title": "Kernel Log Readable by Unprivileged Users", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that only privileged users can read the kernel log (dmesg).", "standards": { "cwe": [ "CWE-497" ], "nist": [ "AC-6", "CM-6" ], "cis_topic": "Kernel parameters: kernel.dmesg_restrict", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-KRN-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-004", "title": "Setuid Programs May Dump Core", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that privileged programs do not write core dumps.", "standards": { "cwe": [ "CWE-528" ], "nist": [ "AC-6", "CM-6" ], "cis_topic": "Kernel parameters: fs.suid_dumpable", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-KRN-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-005", "title": "IP Forwarding Enabled", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that the server does not route packets between networks.", "standards": { "cwe": [ "CWE-1188" ], "nist": [ "SC-7", "CM-6" ], "cis_topic": "Kernel parameters: net.ipv4.ip_forward", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-KRN-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-006", "title": "ICMP Redirects Accepted", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that the kernel ignores ICMP redirect messages.", "standards": { "cwe": [ "CWE-940" ], "nist": [ "SC-7", "CM-6" ], "cis_topic": "Kernel parameters: net.ipv4.conf.all.accept_redirects", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-KRN-006.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-007", "title": "Source-Routed Packets Accepted", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that the kernel drops packets that dictate their own route.", "standards": { "cwe": [ "CWE-940" ], "nist": [ "SC-7", "CM-6" ], "cis_topic": "Kernel parameters: net.ipv4.conf.all.accept_source_route", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-KRN-007.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-008", "title": "TCP SYN Cookies Disabled", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "category": "Secure Configuration", "effort": "low", "summary": "Checks that SYN cookies protect the server from SYN flood attacks.", "standards": { "cwe": [ "CWE-770" ], "nist": [ "SC-5", "CM-6" ], "cis_topic": "Kernel parameters: net.ipv4.tcp_syncookies", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-KRN-008.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-009", "title": "Unprivileged eBPF Allowed", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "category": "Secure Configuration", "effort": "low", "summary": "Checks that normal users cannot load eBPF programs into the kernel.", "standards": { "cwe": [ "CWE-749" ], "nist": [ "CM-6", "SI-16" ], "cis_topic": "Kernel parameters: kernel.unprivileged_bpf_disabled", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-KRN-009.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-010", "title": "Process Tracing Not Restricted", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that processes cannot attach a debugger to other processes of the same user.", "standards": { "cwe": [ "CWE-749" ], "nist": [ "AC-6", "CM-6" ], "cis_topic": "Kernel parameters: kernel.yama.ptrace_scope", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-KRN-010.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-011", "title": "Symlink Protection Disabled", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that the kernel blocks following symlinks owned by other users in world-writable sticky directories.", "standards": { "cwe": [ "CWE-59" ], "nist": [ "AC-6", "CM-6" ], "cis_topic": "Kernel parameters: fs.protected_symlinks", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-KRN-011.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-012", "title": "Hardlink Protection Disabled", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that users cannot create hard links to files they do not own.", "standards": { "cwe": [ "CWE-59" ], "nist": [ "AC-6", "CM-6" ], "cis_topic": "Kernel parameters: fs.protected_hardlinks", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-KRN-012.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-013", "title": "Reverse Path Filtering Disabled", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that the kernel drops packets whose source address could not be routed back through the receiving interface.", "standards": { "cwe": [ "CWE-940" ], "nist": [ "SC-7", "CM-6" ], "cis_topic": "Kernel parameters: net.ipv4.conf.all.rp_filter", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-KRN-013.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-014", "title": "Martian Packets Not Logged", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that packets with impossible source addresses are logged.", "standards": { "cwe": [ "CWE-778" ], "nist": [ "SC-7", "CM-6" ], "cis_topic": "Kernel parameters: net.ipv4.conf.all.log_martians", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-KRN-014.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-015", "title": "Server Sends ICMP Redirects", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that the server does not send ICMP redirects, which only routers should do.", "standards": { "cwe": [ "CWE-1188" ], "nist": [ "SC-7", "CM-6" ], "cis_topic": "Kernel parameters: net.ipv4.conf.all.send_redirects", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-KRN-015.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-016", "title": "Broadcast ICMP Echo Answered", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "category": "Secure Configuration", "effort": "low", "summary": "Checks that the server ignores ping requests sent to broadcast addresses.", "standards": { "cwe": [ "CWE-406" ], "nist": [ "SC-5", "CM-6" ], "cis_topic": "Kernel parameters: net.ipv4.icmp_echo_ignore_broadcasts", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-KRN-016.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-017", "title": "IPv6 ICMP Redirects Accepted", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that the kernel ignores IPv6 ICMP redirect messages.", "standards": { "cwe": [ "CWE-940" ], "nist": [ "SC-7", "CM-6" ], "cis_topic": "Kernel parameters: net.ipv6.conf.all.accept_redirects", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-KRN-017.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-018", "title": "Performance Events Open to Unprivileged Users", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that unprivileged users cannot use kernel performance events to observe the system.", "standards": { "cwe": [ "CWE-749" ], "nist": [ "CM-6", "SI-16" ], "cis_topic": "Kernel parameters: kernel.perf_event_paranoid", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-KRN-018.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-019", "title": "Magic SysRq Key Enabled", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "category": "Secure Configuration", "effort": "low", "summary": "Checks that the magic SysRq key combination is disabled or limited to keyboard synchronisation.", "standards": { "cwe": [ "CWE-749" ], "nist": [ "AC-6", "CM-6" ], "cis_topic": "Kernel parameters: kernel.sysrq", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-KRN-019.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-020", "title": "FIFO Protection in Shared Directories Disabled", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that the kernel refuses to open FIFOs in world-writable sticky directories that another user owns.", "standards": { "cwe": [ "CWE-59" ], "nist": [ "AC-6", "CM-6" ], "cis_topic": "Kernel parameters: fs.protected_fifos", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-KRN-020.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-021", "title": "Regular File Protection in Shared Directories Disabled", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that the kernel refuses to open, with O_CREAT, regular files in world-writable sticky directories that another user owns.", "standards": { "cwe": [ "CWE-59" ], "nist": [ "AC-6", "CM-6" ], "cis_topic": "Kernel parameters: fs.protected_regular", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-KRN-021.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-022", "title": "Unprivileged User Namespaces Allowed", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that normal users cannot create user namespaces, unless the server runs containers that need them.", "standards": { "cwe": [ "CWE-749" ], "nist": [ "CM-6", "CM-7" ], "cis_topic": "Kernel parameters: user namespaces (CIS Controls v8 4.1)", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-KRN-022.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel_depth.go", "source_file": "internal/checks/host/kernel_depth.go" }, { "id": "HOST-KRN-023", "title": "IPv6 Source-Routed Packets Accepted", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that the kernel drops IPv6 packets that dictate their own route.", "standards": { "cwe": [ "CWE-940" ], "nist": [ "SC-7", "CM-6" ], "cis_topic": "Kernel parameters: net.ipv6.conf.all.accept_source_route", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-KRN-023.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-024", "title": "Secure ICMP Redirects Accepted", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that the kernel also ignores ICMP redirects that come from its configured gateways.", "standards": { "cwe": [ "CWE-940" ], "nist": [ "SC-7", "CM-6" ], "cis_topic": "Kernel parameters: net.ipv4.conf.all.secure_redirects", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-KRN-024.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-025", "title": "IPv6 Router Advertisements Accepted", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that the server does not reconfigure its IPv6 addresses and routes from router advertisements.", "standards": { "cwe": [ "CWE-940" ], "nist": [ "SC-7", "CM-6" ], "cis_topic": "Kernel parameters: net.ipv6.conf.all.accept_ra", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-KRN-025.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-026", "title": "Bogus ICMP Error Responses Logged", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "category": "Secure Configuration", "effort": "low", "summary": "Checks that the kernel silently ignores malformed ICMP error responses instead of logging each one.", "standards": { "cwe": [ "CWE-779" ], "nist": [ "SC-7", "CM-6" ], "cis_topic": "Kernel parameters: net.ipv4.icmp_ignore_bogus_error_responses", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-KRN-026.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-027", "title": "Kexec Kernel Replacement Allowed", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L", "category": "Secure Configuration", "effort": "low", "summary": "Checks that a running kernel cannot be replaced at run time with kexec.", "standards": { "cwe": [ "CWE-749" ], "nist": [ "AC-6", "CM-6" ], "cis_topic": "Kernel parameters: kernel.kexec_load_disabled", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-KRN-027.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-028", "title": "Unprivileged userfaultfd Allowed", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that only privileged processes can use userfaultfd.", "standards": { "cwe": [ "CWE-749" ], "nist": [ "AC-6", "CM-6" ], "cis_topic": "Kernel parameters: vm.unprivileged_userfaultfd", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-KRN-028.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-029", "title": "TTY Line Discipline Autoloading Enabled", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that unprivileged users cannot make the kernel load terminal line discipline modules.", "standards": { "cwe": [ "CWE-1188" ], "nist": [ "AC-6", "CM-6" ], "cis_topic": "Kernel parameters: dev.tty.ldisc_autoload", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-KRN-029.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-030", "title": "BPF JIT Hardening Off", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that the BPF just-in-time compiler blinds constants in generated code for every user.", "standards": { "cwe": [ "CWE-1188" ], "nist": [ "SC-7", "CM-6" ], "cis_topic": "Kernel parameters: net.core.bpf_jit_harden", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-KRN-030.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-KRN-031", "title": "io_uring Open to Unprivileged Users", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks that io_uring is disabled, or limited to privileged processes, on kernels that offer the setting.", "standards": { "cwe": [ "CWE-749" ], "nist": [ "AC-6", "CM-6" ], "cis_topic": "Kernel parameters: kernel.io_uring_disabled", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1", "P17" ], "page": "https://openvapt.com/checks/HOST-KRN-031.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/kernel.go", "source_file": "internal/checks/host/kernel.go" }, { "id": "HOST-LOG-001", "title": "System Logging Not Persistent", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "category": "Logging and Monitoring", "effort": "low", "summary": "Checks that system logs survive a reboot (rsyslog/syslog-ng running, or a persistent journal).", "standards": { "cwe": [ "CWE-778" ], "owasp": [ "A09:2021" ], "nist": [ "AU-2", "AU-9", "AU-11" ], "cis_topic": "Logging: persistent system logs", "cis_v8": [ "8.2" ], "csf_2": [ "PR.PS-04" ] }, "cis_controls_v8": [ "8.2" ], "nist_csf_2": [ "PR.PS-04" ], "academy_modules": [ "P16", "A4" ], "page": "https://openvapt.com/checks/HOST-LOG-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/logging_time.go", "source_file": "internal/checks/host/logging_time.go" }, { "id": "HOST-LOG-002", "title": "Security Audit Daemon Not Running", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "category": "Logging and Monitoring", "effort": "medium", "summary": "Checks whether the Linux audit daemon (auditd) is running.", "standards": { "cwe": [ "CWE-778" ], "owasp": [ "A09:2021" ], "nist": [ "AU-2", "AU-12" ], "cis_topic": "Logging and auditing: auditd", "cis_v8": [ "8.2" ], "csf_2": [ "PR.PS-04" ] }, "cis_controls_v8": [ "8.2" ], "nist_csf_2": [ "PR.PS-04" ], "academy_modules": [ "P16" ], "page": "https://openvapt.com/checks/HOST-LOG-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/logging_time.go", "source_file": "internal/checks/host/logging_time.go" }, { "id": "HOST-LOG-003", "title": "Security Logs Readable by All Users", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Logging and Monitoring", "effort": "low", "summary": "Checks that authentication and system logs are not world-readable.", "standards": { "cwe": [ "CWE-532" ], "nist": [ "AC-3", "AC-6" ], "cis_v8": [ "8.2" ], "csf_2": [ "PR.PS-04" ] }, "cis_controls_v8": [ "8.2" ], "nist_csf_2": [ "PR.PS-04" ], "academy_modules": [ "P16" ], "page": "https://openvapt.com/checks/HOST-LOG-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hardening.go", "source_file": "internal/checks/host/hardening.go" }, { "id": "HOST-LOG-004", "title": "Log Rotation Not Configured", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "category": "Logging and Monitoring", "effort": "low", "summary": "Checks that logrotate (or journald size limits) keeps logs from filling the disk.", "standards": { "cwe": [ "CWE-770" ], "nist": [ "AU-4", "AU-11" ], "cis_v8": [ "8.3" ], "csf_2": [ "PR.PS-04" ] }, "cis_controls_v8": [ "8.3" ], "nist_csf_2": [ "PR.PS-04" ], "academy_modules": [ "P16" ], "page": "https://openvapt.com/checks/HOST-LOG-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hardening.go", "source_file": "internal/checks/host/hardening.go" }, { "id": "HOST-MAC-001", "title": "No Mandatory Access Control Enforced", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "high", "summary": "Checks that AppArmor or SELinux is enabled and enforcing.", "standards": { "cwe": [ "CWE-250" ], "nist": [ "AC-3(3)", "AC-6" ], "cis_topic": "Mandatory access control", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-MAC-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hardening.go", "source_file": "internal/checks/host/hardening.go" }, { "id": "HOST-OS-001", "title": "Operating System Past End of Security Support", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Patch and Vulnerability Management", "effort": "high", "summary": "Checks whether the Linux distribution release still receives free security updates.", "standards": { "cwe": [ "CWE-1104" ], "owasp": [ "A06:2021" ], "nist": [ "SA-22", "SI-2" ], "cis_topic": "Supported operating system versions", "cis_v8": [ "2.2" ], "csf_2": [ "ID.RA-01", "PR.PS-02" ] }, "cis_controls_v8": [ "2.2" ], "nist_csf_2": [ "ID.RA-01", "PR.PS-02" ], "academy_modules": [ "F3", "P1" ], "page": "https://openvapt.com/checks/HOST-OS-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/os_patch.go", "source_file": "internal/checks/host/os_patch.go" }, { "id": "HOST-PAM-001", "title": "Password Quality Module Not Enforced", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "Checks that new passwords pass through pam_pwquality with its dictionary check on, so dictionary words and user-name variants are rejected.", "standards": { "cwe": [ "CWE-521" ], "owasp": [ "A07:2021" ], "nist": [ "IA-5(1)" ], "cis_topic": "Password creation requirements enforced through PAM (CIS Controls v8 5.2)", "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P22" ], "page": "https://openvapt.com/checks/HOST-PAM-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/pam_login.go", "source_file": "internal/checks/host/pam_login.go" }, { "id": "HOST-PAM-002", "title": "Account Lockout Releases Too Quickly", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "Checks that a locked account stays locked for at least 15 minutes (or until an administrator unlocks it).", "standards": { "cwe": [ "CWE-307" ], "owasp": [ "A07:2021" ], "nist": [ "AC-7" ], "cis_topic": "Lockout duration for failed password attempts (CIS Controls v8 5.2)", "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P22" ], "page": "https://openvapt.com/checks/HOST-PAM-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/pam_login.go", "source_file": "internal/checks/host/pam_login.go" }, { "id": "HOST-PAM-003", "title": "su Not Restricted to an Administrative Group", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "Checks that only members of a named group (wheel or sudo) may use su to become another user.", "standards": { "cwe": [ "CWE-250", "CWE-862" ], "nist": [ "AC-6(2)", "AC-3" ], "cis_topic": "Access to the su command is restricted (CIS Controls v8 5.4)", "cis_v8": [ "5.4" ], "csf_2": [ "PR.AA-05" ] }, "cis_controls_v8": [ "5.4" ], "nist_csf_2": [ "PR.AA-05" ], "academy_modules": [ "P22" ], "page": "https://openvapt.com/checks/HOST-PAM-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/pam_login.go", "source_file": "internal/checks/host/pam_login.go" }, { "id": "HOST-PAM-004", "title": "Password History Not Enforced", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "Checks that PAM remembers at least the last 5 passwords so a changed password cannot be changed straight back.", "standards": { "cwe": [ "CWE-262" ], "owasp": [ "A07:2021" ], "nist": [ "IA-5(1)" ], "cis_topic": "Password reuse is limited (CIS Controls v8 5.2)", "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P22" ], "page": "https://openvapt.com/checks/HOST-PAM-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/pam_login.go", "source_file": "internal/checks/host/pam_login.go" }, { "id": "HOST-PAM-005", "title": "Minimum Password Age Not Set", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "Checks that a password cannot be changed again on the same day it was set.", "standards": { "cwe": [ "CWE-262" ], "owasp": [ "A07:2021" ], "nist": [ "IA-5(1)" ], "cis_topic": "Minimum days between password changes (CIS Controls v8 5.2)", "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P22" ], "page": "https://openvapt.com/checks/HOST-PAM-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/pam_login.go", "source_file": "internal/checks/host/pam_login.go" }, { "id": "HOST-PAM-006", "title": "Password Expiry Warning Too Short", "domain": "host", "severity": "info", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "Reports whether users are warned at least 7 days before a password expires.", "standards": { "cwe": [ "CWE-262" ], "owasp": [ "A07:2021" ], "nist": [ "IA-5(1)" ], "cis_topic": "Password expiration warning days (CIS Controls v8 5.2)", "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P22" ], "page": "https://openvapt.com/checks/HOST-PAM-006.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/pam_login.go", "source_file": "internal/checks/host/pam_login.go" }, { "id": "HOST-PAM-007", "title": "Inactive Accounts Never Locked", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "Checks that new accounts are set to lock automatically after a password has been expired and unused for at most 30 days.", "standards": { "cwe": [ "CWE-262" ], "nist": [ "AC-2(3)" ], "cis_topic": "Inactive password lock (CIS Controls v8 5.3)", "cis_v8": [ "5.3" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.3" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P22" ], "page": "https://openvapt.com/checks/HOST-PAM-007.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/pam_login.go", "source_file": "internal/checks/host/pam_login.go" }, { "id": "HOST-PAM-008", "title": "Root PATH Contains Unsafe Entries", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "category": "Identity and Authentication", "effort": "low", "summary": "Checks that the PATH set for root does not include the current directory, empty entries, relative paths or directories other users can write to.", "standards": { "cwe": [ "CWE-426", "CWE-427" ], "nist": [ "CM-6", "AC-6" ], "cis_topic": "Root PATH integrity (CIS Controls v8 4.1)", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P22" ], "page": "https://openvapt.com/checks/HOST-PAM-008.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/pam_login.go", "source_file": "internal/checks/host/pam_login.go" }, { "id": "HOST-PAM-009", "title": "No Shell Idle Timeout", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "Checks that interactive shells log out after at most 15 minutes without input (TMOUT).", "standards": { "cwe": [ "CWE-613" ], "owasp": [ "A07:2021" ], "nist": [ "AC-11", "AC-12" ], "cis_topic": "Default user shell timeout (CIS Controls v8 4.3)", "cis_v8": [ "4.3" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.3" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P22" ], "page": "https://openvapt.com/checks/HOST-PAM-009.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/pam_login.go", "source_file": "internal/checks/host/pam_login.go" }, { "id": "HOST-PKG-001", "title": "Security Updates Waiting to Be Installed", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Patch and Vulnerability Management", "effort": "medium", "summary": "Checks the package manager for published security updates that are not installed yet.", "standards": { "cwe": [ "CWE-1104" ], "owasp": [ "A06:2021" ], "nist": [ "SI-2", "RA-5" ], "cis_topic": "Patch management: install security updates", "cis_v8": [ "7.3" ], "csf_2": [ "ID.RA-01", "PR.PS-02" ] }, "cis_controls_v8": [ "7.3" ], "nist_csf_2": [ "ID.RA-01", "PR.PS-02" ], "academy_modules": [ "F3", "P1" ], "page": "https://openvapt.com/checks/HOST-PKG-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/os_patch.go", "source_file": "internal/checks/host/os_patch.go" }, { "id": "HOST-PKG-002", "title": "Repository Signature Checks Disabled", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Patch and Vulnerability Management", "effort": "low", "summary": "Checks that the package manager verifies repository signatures, so a tampered mirror or intercepted download cannot install code as root.", "standards": { "cwe": [ "CWE-494", "CWE-347" ], "owasp": [ "A08:2021" ], "nist": [ "SI-7", "CM-14", "SR-3", "SR-11" ], "cis_topic": "Package manager repositories and GPG keys are configured", "cis_v8": [ "7.3" ], "csf_2": [ "ID.RA-01", "PR.PS-02" ] }, "cis_controls_v8": [ "7.3" ], "nist_csf_2": [ "ID.RA-01", "PR.PS-02" ], "academy_modules": [ "P1", "P22" ], "page": "https://openvapt.com/checks/HOST-PKG-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/pkg_depth.go", "source_file": "internal/checks/host/pkg_depth.go" }, { "id": "HOST-PKG-003", "title": "Third-Party Package Repositories Present", "domain": "host", "severity": "info", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N", "category": "Patch and Vulnerability Management", "effort": "medium", "summary": "Lists package repositories that are not run by the distribution vendor, so each one can be justified.", "standards": { "cwe": [ "CWE-1357" ], "owasp": [ "A08:2021" ], "nist": [ "CM-8", "SR-3", "SR-4" ], "cis_topic": "Software inventory: authorised repositories (CIS Controls v8 2.5)", "cis_v8": [ "2.5" ], "csf_2": [ "PR.PS-05" ] }, "cis_controls_v8": [ "2.5" ], "nist_csf_2": [ "PR.PS-05" ], "academy_modules": [ "P1", "P22" ], "page": "https://openvapt.com/checks/HOST-PKG-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/pkg_depth.go", "source_file": "internal/checks/host/pkg_depth.go" }, { "id": "HOST-PKG-004", "title": "Many Old Kernels Retained", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N", "category": "Patch and Vulnerability Management", "effort": "low", "summary": "Checks that no more than three kernel versions are installed.", "standards": { "cwe": [ "CWE-1104" ], "owasp": [ "A06:2021" ], "nist": [ "SI-2", "CM-7" ], "cis_topic": "Remove unneeded software versions", "cis_v8": [ "7.3" ], "csf_2": [ "ID.RA-01", "PR.PS-02" ] }, "cis_controls_v8": [ "7.3" ], "nist_csf_2": [ "ID.RA-01", "PR.PS-02" ], "academy_modules": [ "P1", "P22" ], "page": "https://openvapt.com/checks/HOST-PKG-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/pkg_depth.go", "source_file": "internal/checks/host/pkg_depth.go" }, { "id": "HOST-PKG-005", "title": "Running Kernel Older Than Installed Kernel", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "category": "Patch and Vulnerability Management", "effort": "medium", "summary": "Checks that the kernel in memory is the newest kernel installed, so kernel security fixes are actually in effect.", "standards": { "cwe": [ "CWE-1104" ], "owasp": [ "A06:2021" ], "nist": [ "SI-2", "RA-5" ], "cis_topic": "Apply installed kernel updates (CIS Controls v8 7.4)", "cis_v8": [ "7.4" ], "csf_2": [ "ID.RA-01", "PR.PS-02" ] }, "cis_controls_v8": [ "7.4" ], "nist_csf_2": [ "ID.RA-01", "PR.PS-02" ], "academy_modules": [ "P1", "P22" ], "page": "https://openvapt.com/checks/HOST-PKG-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/pkg_depth.go", "source_file": "internal/checks/host/pkg_depth.go" }, { "id": "HOST-PKG-006", "title": "Package Lists Not Refreshed Automatically", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Patch and Vulnerability Management", "effort": "low", "summary": "Checks that the package manager downloads fresh repository metadata on a schedule, so pending updates can be seen at all.", "standards": { "cwe": [ "CWE-1104" ], "owasp": [ "A06:2021" ], "nist": [ "SI-2", "RA-5" ], "cis_topic": "Automated patch management (CIS Controls v8 7.4)", "cis_v8": [ "7.4" ], "csf_2": [ "ID.RA-01", "PR.PS-02" ] }, "cis_controls_v8": [ "7.4" ], "nist_csf_2": [ "ID.RA-01", "PR.PS-02" ], "academy_modules": [ "P1", "P22" ], "page": "https://openvapt.com/checks/HOST-PKG-006.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/pkg_depth.go", "source_file": "internal/checks/host/pkg_depth.go" }, { "id": "HOST-PWD-001", "title": "Weak Password Hashing Algorithm Configured", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "Checks that new passwords are hashed with a modern, slow algorithm (SHA-512 or yescrypt).", "standards": { "cwe": [ "CWE-916", "CWE-328" ], "owasp": [ "A02:2021" ], "nist": [ "IA-5(1)" ], "cis_topic": "Password hashing algorithm", "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P7", "P15" ], "page": "https://openvapt.com/checks/HOST-PWD-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/passwords.go", "source_file": "internal/checks/host/passwords.go" }, { "id": "HOST-PWD-002", "title": "Accounts With Obsolete Password Hashes", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "Checks /etc/shadow for passwords still stored with MD5 or traditional DES crypt.", "standards": { "cwe": [ "CWE-916", "CWE-328" ], "owasp": [ "A02:2021" ], "nist": [ "IA-5(1)" ], "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P7", "P15" ], "page": "https://openvapt.com/checks/HOST-PWD-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/passwords.go", "source_file": "internal/checks/host/passwords.go" }, { "id": "HOST-PWD-003", "title": "Short Minimum Password Length", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "Checks that the password quality policy requires at least 15 characters.", "standards": { "cwe": [ "CWE-521" ], "owasp": [ "A07:2021" ], "nist": [ "IA-5(1)" ], "cis_topic": "Password creation requirements", "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P7", "P15" ], "page": "https://openvapt.com/checks/HOST-PWD-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/passwords.go", "source_file": "internal/checks/host/passwords.go" }, { "id": "HOST-PWD-004", "title": "No Account Lockout After Failed Logins", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "category": "Identity and Authentication", "effort": "medium", "summary": "Checks that PAM temporarily locks accounts after repeated failed logins.", "standards": { "cwe": [ "CWE-307" ], "owasp": [ "A07:2021" ], "nist": [ "AC-7" ], "cis_topic": "Lockout for failed password attempts", "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P7", "P15" ], "page": "https://openvapt.com/checks/HOST-PWD-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/passwords.go", "source_file": "internal/checks/host/passwords.go" }, { "id": "HOST-PWD-005", "title": "Forced Periodic Password Rotation Configured", "domain": "host", "severity": "info", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "Reports whether new accounts are forced to change passwords on a short fixed schedule.", "standards": { "cwe": [ "CWE-262" ], "nist": [ "IA-5(1)" ], "cis_topic": "Password expiration", "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P7", "P15" ], "page": "https://openvapt.com/checks/HOST-PWD-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/passwords.go", "source_file": "internal/checks/host/passwords.go" }, { "id": "HOST-SEC-001", "title": "Secrets in World-Readable Files", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "category": "Information Exposure", "effort": "medium", "summary": "Looks inside world-readable configuration files under /etc and the web roots for private keys, cloud access keys and password assignments.", "standards": { "cwe": [ "CWE-312", "CWE-732", "CWE-798" ], "owasp": [ "A02:2021", "A05:2021" ], "nist": [ "IA-5", "SC-28", "AC-3" ], "cis_topic": "Protect credentials and keys at rest", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P20" ], "page": "https://openvapt.com/checks/HOST-SEC-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hygiene.go", "source_file": "internal/checks/host/hygiene.go" }, { "id": "HOST-SSH-001", "title": "SSH Allows Direct Root Login", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Identity and Authentication", "effort": "low", "summary": "Checks whether the SSH daemon accepts logins as root with a password.", "standards": { "cwe": [ "CWE-250" ], "nist": [ "AC-6(2)", "IA-2" ], "cis_topic": "SSH server configuration: root login", "cis_v8": [ "5.4" ], "csf_2": [ "PR.AA-05" ] }, "cis_controls_v8": [ "5.4" ], "nist_csf_2": [ "PR.AA-05" ], "academy_modules": [ "P2", "P15", "P23", "A2" ], "page": "https://openvapt.com/checks/HOST-SSH-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/ssh_root_login.go", "source_file": "internal/checks/host/ssh_root_login.go" }, { "id": "HOST-SSH-002", "title": "SSH Password Authentication Enabled", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "Checks whether SSH accepts passwords instead of only keys.", "standards": { "cwe": [ "CWE-307", "CWE-521" ], "nist": [ "IA-2(1)", "IA-5" ], "cis_topic": "SSH server configuration: authentication methods", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P2", "P15" ], "page": "https://openvapt.com/checks/HOST-SSH-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/ssh_password_auth.go", "source_file": "internal/checks/host/ssh_password_auth.go" }, { "id": "HOST-SSH-003", "title": "SSH Permits Empty Passwords", "domain": "host", "severity": "critical", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Identity and Authentication", "effort": "low", "summary": "Checks whether SSH lets accounts with an empty password log in.", "standards": { "cwe": [ "CWE-258" ], "nist": [ "IA-5(1)" ], "cis_topic": "SSH server configuration: empty passwords", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P2", "P15" ], "page": "https://openvapt.com/checks/HOST-SSH-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/ssh_empty_passwords.go", "source_file": "internal/checks/host/ssh_empty_passwords.go" }, { "id": "HOST-SSH-004", "title": "SSH Offers Weak Cryptography", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "category": "Cryptography and TLS", "effort": "low", "summary": "Checks the SSH ciphers, MACs, key exchange and host key algorithms for outdated choices.", "standards": { "cwe": [ "CWE-327" ], "owasp": [ "A02:2021" ], "nist": [ "SC-8", "SC-13" ], "cis_topic": "SSH server configuration: approved ciphers, MACs and KEX", "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P2" ], "page": "https://openvapt.com/checks/HOST-SSH-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/ssh_weak_crypto.go", "source_file": "internal/checks/host/ssh_weak_crypto.go" }, { "id": "HOST-SSH-005", "title": "SSH X11 Forwarding Enabled", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks whether SSH forwards graphical X11 sessions.", "standards": { "cwe": [ "CWE-1188" ], "nist": [ "CM-7" ], "cis_topic": "SSH server configuration: X11 forwarding", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P2" ], "page": "https://openvapt.com/checks/HOST-SSH-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/ssh_misc.go", "source_file": "internal/checks/host/ssh_misc.go" }, { "id": "HOST-SSH-006", "title": "SSH Allows Many Authentication Attempts", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "Checks whether MaxAuthTries is above 4.", "standards": { "cwe": [ "CWE-307" ], "nist": [ "AC-7" ], "cis_topic": "SSH server configuration: MaxAuthTries", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P2", "P15" ], "page": "https://openvapt.com/checks/HOST-SSH-006.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/ssh_misc.go", "source_file": "internal/checks/host/ssh_misc.go" }, { "id": "HOST-SSH-007", "title": "SSH Forwarding Features Enabled", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks effective SSH Match contexts for TCP, agent, tunnel and gateway forwarding.", "standards": { "cwe": [ "CWE-441" ], "nist": [ "AC-4", "CM-7" ], "cis_topic": "SSH server configuration: forwarding", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P2" ], "page": "https://openvapt.com/checks/HOST-SSH-007.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/ssh_forwarding.go", "source_file": "internal/checks/host/ssh_forwarding.go" }, { "id": "HOST-SSH-008", "title": "SSH Authentication Controls Too Permissive", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "Checks effective SSH authentication method and login grace settings.", "standards": { "cwe": [ "CWE-307", "CWE-308" ], "nist": [ "AC-7", "IA-2" ], "cis_topic": "SSH server configuration: authentication restrictions", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P2", "P15" ], "page": "https://openvapt.com/checks/HOST-SSH-008.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/ssh_forwarding.go", "source_file": "internal/checks/host/ssh_forwarding.go" }, { "id": "HOST-SSH-009", "title": "SSH Host Private Keys Readable by Others", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "category": "Cryptography and TLS", "effort": "low", "summary": "Checks that SSH host private keys are readable only by root.", "standards": { "cwe": [ "CWE-732" ], "nist": [ "AC-3", "AC-6" ], "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P2" ], "page": "https://openvapt.com/checks/HOST-SSH-009.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hardening.go", "source_file": "internal/checks/host/hardening.go" }, { "id": "HOST-SSH-010", "title": "SSH Server Configuration Writable by Non-Root Users", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "category": "Access Control", "effort": "low", "summary": "Checks that the SSH daemon configuration cannot be modified by group or other users.", "standards": { "cwe": [ "CWE-732" ], "nist": [ "AC-3", "AC-6" ], "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P2" ], "page": "https://openvapt.com/checks/HOST-SSH-010.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hardening.go", "source_file": "internal/checks/host/hardening.go" }, { "id": "HOST-SSH-011", "title": "SSH Legacy Trust Options Enabled", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "category": "Identity and Authentication", "effort": "low", "summary": "Checks for host-based trust and user environment options that weaken SSH authentication.", "standards": { "cwe": [ "CWE-290", "CWE-15" ], "nist": [ "IA-2", "CM-6" ], "cis_topic": "SSH host-based authentication and user environment", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P2" ], "page": "https://openvapt.com/checks/HOST-SSH-011.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hardening.go", "source_file": "internal/checks/host/hardening.go" }, { "id": "HOST-SSH-012", "title": "SSH Logging Level Too Low", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "category": "Logging and Monitoring", "effort": "low", "summary": "Checks that sshd logs at INFO or VERBOSE level.", "standards": { "cwe": [ "CWE-778" ], "owasp": [ "A09:2021" ], "nist": [ "AU-2", "AU-3" ], "cis_v8": [ "8.2" ], "csf_2": [ "PR.PS-04" ] }, "cis_controls_v8": [ "8.2" ], "nist_csf_2": [ "PR.PS-04" ], "academy_modules": [ "P2", "P16" ], "page": "https://openvapt.com/checks/HOST-SSH-012.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hardening.go", "source_file": "internal/checks/host/hardening.go" }, { "id": "HOST-SSH-013", "title": "SSH Authorized Keys Without Restrictions or Protection", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "Checks root's authorized_keys for keys without from= or command= options, and every authorized_keys file for permissive modes.", "standards": { "cwe": [ "CWE-732", "CWE-250" ], "nist": [ "IA-5", "AC-6", "AC-17" ], "cis_topic": "SSH key management and file permissions", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P2", "P20" ], "page": "https://openvapt.com/checks/HOST-SSH-013.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hygiene.go", "source_file": "internal/checks/host/hygiene.go" }, { "id": "HOST-SUDO-001", "title": "Sudo Commands Not Logged to a Dedicated File", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "category": "Logging and Monitoring", "effort": "low", "summary": "Checks that sudo uses a pseudo-terminal and keeps its own log file.", "standards": { "cwe": [ "CWE-778" ], "owasp": [ "A09:2021" ], "nist": [ "AU-2", "AU-12" ], "cis_topic": "Sudo uses pty and log file", "cis_v8": [ "8.2" ], "csf_2": [ "PR.PS-04" ] }, "cis_controls_v8": [ "8.2" ], "nist_csf_2": [ "PR.PS-04" ], "academy_modules": [ "P7", "P15", "P16" ], "page": "https://openvapt.com/checks/HOST-SUDO-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hardening.go", "source_file": "internal/checks/host/hardening.go" }, { "id": "HOST-SVC-001", "title": "Unnecessary Legacy Services Running", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks for desktop and legacy network services that servers rarely need.", "standards": { "cwe": [ "CWE-1188" ], "nist": [ "CM-7" ], "cis_topic": "Remove or disable unnecessary services", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-SVC-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hardening.go", "source_file": "internal/checks/host/hardening.go" }, { "id": "HOST-SVC-002", "title": "Telnet Server Installed or Enabled", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks whether a Telnet server is installed or set to start at boot.", "standards": { "cwe": [ "CWE-319", "CWE-1188" ], "nist": [ "CM-7", "CM-7(1)", "SC-8" ], "cis_topic": "Telnet server is not installed (CIS Controls v8 4.8)", "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P1", "P22" ], "page": "https://openvapt.com/checks/HOST-SVC-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/legacy_services.go", "source_file": "internal/checks/host/legacy_services.go" }, { "id": "HOST-SVC-003", "title": "rsh, rlogin, rexec or finger Server Installed or Enabled", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks whether the Berkeley r-services (rsh, rlogin, rexec) or a finger server is installed or enabled.", "standards": { "cwe": [ "CWE-319", "CWE-1188" ], "nist": [ "CM-7", "CM-7(1)", "SC-8" ], "cis_topic": "rsh and finger servers are not installed (CIS Controls v8 4.8)", "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P1", "P22" ], "page": "https://openvapt.com/checks/HOST-SVC-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/legacy_services.go", "source_file": "internal/checks/host/legacy_services.go" }, { "id": "HOST-SVC-004", "title": "TFTP Server Installed or Enabled", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks whether a TFTP server is installed or set to start at boot.", "standards": { "cwe": [ "CWE-306", "CWE-1188" ], "nist": [ "CM-7", "CM-7(1)", "SC-8" ], "cis_topic": "TFTP server is not installed (CIS Controls v8 4.8)", "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P1", "P22" ], "page": "https://openvapt.com/checks/HOST-SVC-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/legacy_services.go", "source_file": "internal/checks/host/legacy_services.go" }, { "id": "HOST-SVC-005", "title": "FTP Server Installed or Enabled", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks whether an FTP server (vsftpd, ProFTPD or Pure-FTPd) is installed or set to start at boot.", "standards": { "cwe": [ "CWE-319", "CWE-1188" ], "nist": [ "CM-7", "CM-7(1)", "SC-8" ], "cis_topic": "FTP server is not installed (CIS Controls v8 4.8)", "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P1", "P22" ], "page": "https://openvapt.com/checks/HOST-SVC-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/legacy_services.go", "source_file": "internal/checks/host/legacy_services.go" }, { "id": "HOST-SVC-006", "title": "NIS Server or Client Installed or Enabled", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks whether the Network Information Service (NIS, ypserv or ypbind) is installed or enabled.", "standards": { "cwe": [ "CWE-319", "CWE-522" ], "nist": [ "CM-7", "CM-7(1)", "SC-8" ], "cis_topic": "NIS server and client are not installed (CIS Controls v8 4.8)", "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P1", "P22" ], "page": "https://openvapt.com/checks/HOST-SVC-006.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/legacy_services.go", "source_file": "internal/checks/host/legacy_services.go" }, { "id": "HOST-SVC-007", "title": "Avahi or CUPS Installed or Enabled", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks whether zero-configuration discovery (Avahi) or the printing system (CUPS) is installed or enabled.", "standards": { "cwe": [ "CWE-1188" ], "nist": [ "CM-7", "CM-7(1)" ], "cis_topic": "Avahi and CUPS are not installed (CIS Controls v8 4.8)", "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P1", "P22" ], "page": "https://openvapt.com/checks/HOST-SVC-007.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/legacy_services.go", "source_file": "internal/checks/host/legacy_services.go" }, { "id": "HOST-SVC-008", "title": "NFS Server or rpcbind Installed or Enabled", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks whether the NFS server or the RPC port mapper (rpcbind) is installed or enabled.", "standards": { "cwe": [ "CWE-1188", "CWE-306" ], "nist": [ "CM-7", "CM-7(1)" ], "cis_topic": "NFS and rpcbind are not installed unless required (CIS Controls v8 4.8)", "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P1", "P22" ], "page": "https://openvapt.com/checks/HOST-SVC-008.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/legacy_services.go", "source_file": "internal/checks/host/legacy_services.go" }, { "id": "HOST-SVC-009", "title": "DHCP or DNS Server Installed or Enabled", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks whether a DHCP server or an authoritative or recursive DNS server (BIND) is installed or enabled on a machine that is not a network server.", "standards": { "cwe": [ "CWE-1188" ], "nist": [ "CM-7", "CM-7(1)" ], "cis_topic": "DHCP and DNS servers are not installed unless required (CIS Controls v8 4.8)", "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P1", "P22" ], "page": "https://openvapt.com/checks/HOST-SVC-009.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/legacy_services.go", "source_file": "internal/checks/host/legacy_services.go" }, { "id": "HOST-SVC-010", "title": "Samba File Server Installed or Enabled", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks whether the Samba SMB file server is installed or set to start at boot.", "standards": { "cwe": [ "CWE-1188" ], "nist": [ "CM-7", "CM-7(1)" ], "cis_topic": "Samba is not installed unless required (CIS Controls v8 4.8)", "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P1", "P22" ], "page": "https://openvapt.com/checks/HOST-SVC-010.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/legacy_services.go", "source_file": "internal/checks/host/legacy_services.go" }, { "id": "HOST-SVC-011", "title": "SNMP Agent or Squid Proxy Installed or Enabled", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks whether an SNMP agent or the Squid caching proxy is installed or enabled.", "standards": { "cwe": [ "CWE-1188", "CWE-319" ], "nist": [ "CM-7", "CM-7(1)" ], "cis_topic": "SNMP and proxy servers are not installed unless required (CIS Controls v8 4.8)", "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P1", "P22" ], "page": "https://openvapt.com/checks/HOST-SVC-011.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/legacy_services.go", "source_file": "internal/checks/host/legacy_services.go" }, { "id": "HOST-SVC-012", "title": "inetd Super-Server Installed or Enabled", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks whether xinetd or another inetd super-server is installed or enabled.", "standards": { "cwe": [ "CWE-1188" ], "nist": [ "CM-7", "CM-7(1)" ], "cis_topic": "xinetd and inetd are not installed (CIS Controls v8 4.8)", "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P1", "P22" ], "page": "https://openvapt.com/checks/HOST-SVC-012.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/legacy_services.go", "source_file": "internal/checks/host/legacy_services.go" }, { "id": "HOST-SYSD-001", "title": "Custom Services Run as Root", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "category": "Identity and Authentication", "effort": "medium", "summary": "Checks whether long-running services written by the administrator run as root instead of a dedicated user.", "standards": { "cwe": [ "CWE-250" ], "nist": [ "AC-6", "CM-7" ], "cis_topic": "Run services with least privilege", "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P11" ], "page": "https://openvapt.com/checks/HOST-SYSD-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/systemd.go", "source_file": "internal/checks/host/systemd.go" }, { "id": "HOST-SYSD-002", "title": "Custom Services Lack Sandboxing", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N", "category": "Secure Configuration", "effort": "medium", "summary": "Checks whether custom long-running services use systemd's basic sandboxing options.", "standards": { "cwe": [ "CWE-250", "CWE-653" ], "nist": [ "CM-6", "SC-39", "AC-6" ], "cis_topic": "Service isolation", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P11" ], "page": "https://openvapt.com/checks/HOST-SYSD-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/systemd.go", "source_file": "internal/checks/host/systemd.go" }, { "id": "HOST-SYSD-003", "title": "Service Unit Files Writable by Non-Root Users", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "category": "Access Control", "effort": "low", "summary": "Checks whether any systemd service unit or drop-in file can be changed by a user other than root.", "standards": { "cwe": [ "CWE-732" ], "nist": [ "AC-3", "CM-5" ], "cis_topic": "Protect service definitions", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P11" ], "page": "https://openvapt.com/checks/HOST-SYSD-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/systemd.go", "source_file": "internal/checks/host/systemd.go" }, { "id": "HOST-SYSD-004", "title": "Service Programs in Writable Locations", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "category": "Access Control", "effort": "low", "summary": "Checks whether a service starts a program from a temporary folder, or a program file that other users can replace.", "standards": { "cwe": [ "CWE-732", "CWE-427" ], "nist": [ "AC-3", "CM-5" ], "cis_topic": "Protect service executables", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P11" ], "page": "https://openvapt.com/checks/HOST-SYSD-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/systemd.go", "source_file": "internal/checks/host/systemd.go" }, { "id": "HOST-SYSD-005", "title": "Secrets Written Into Service Unit Files", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks whether passwords, tokens or keys are set with Environment= in systemd unit files.", "standards": { "cwe": [ "CWE-526", "CWE-312" ], "owasp": [ "A05:2021" ], "nist": [ "IA-5", "SC-28" ], "cis_topic": "Protect stored credentials", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P11" ], "page": "https://openvapt.com/checks/HOST-SYSD-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/systemd.go", "source_file": "internal/checks/host/systemd.go" }, { "id": "HOST-TIME-001", "title": "Time Synchronisation Not Active", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "category": "Logging and Monitoring", "effort": "low", "summary": "Checks that the clock is kept in sync (chrony, ntpd or systemd-timesyncd).", "standards": { "cwe": [ "CWE-778" ], "nist": [ "AU-8" ], "cis_topic": "Time synchronisation", "cis_v8": [ "8.4" ], "csf_2": [ "PR.PS-04" ] }, "cis_controls_v8": [ "8.4" ], "nist_csf_2": [ "PR.PS-04" ], "academy_modules": [ "P16" ], "page": "https://openvapt.com/checks/HOST-TIME-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/logging_time.go", "source_file": "internal/checks/host/logging_time.go" }, { "id": "HOST-UPD-001", "title": "Automatic Security Updates Not Configured", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Patch and Vulnerability Management", "effort": "low", "summary": "Checks that security updates are installed automatically.", "standards": { "cwe": [ "CWE-1104" ], "owasp": [ "A06:2021" ], "nist": [ "SI-2(2)" ], "cis_v8": [ "7.3" ], "csf_2": [ "ID.RA-01", "PR.PS-02" ] }, "cis_controls_v8": [ "7.3" ], "nist_csf_2": [ "ID.RA-01", "PR.PS-02" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-UPD-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hardening.go", "source_file": "internal/checks/host/hardening.go" }, { "id": "HOST-UPD-002", "title": "Reboot Required to Apply Updates", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "category": "Patch and Vulnerability Management", "effort": "medium", "summary": "Checks whether installed updates (often kernel or core library fixes) are waiting for a reboot.", "standards": { "cwe": [ "CWE-1104" ], "nist": [ "SI-2" ], "cis_v8": [ "7.3" ], "csf_2": [ "ID.RA-01", "PR.PS-02" ] }, "cis_controls_v8": [ "7.3" ], "nist_csf_2": [ "ID.RA-01", "PR.PS-02" ], "academy_modules": [ "P1" ], "page": "https://openvapt.com/checks/HOST-UPD-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hardening.go", "source_file": "internal/checks/host/hardening.go" }, { "id": "HOST-USR-001", "title": "Extra Accounts With Root Privileges (UID 0)", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "category": "Identity and Authentication", "effort": "medium", "summary": "Checks /etc/passwd for accounts other than root that have user id 0.", "standards": { "cwe": [ "CWE-250", "CWE-266" ], "nist": [ "AC-2", "AC-6" ], "cis_topic": "User accounts: root is the only UID 0 account", "cis_v8": [ "5.4" ], "csf_2": [ "PR.AA-05" ] }, "cis_controls_v8": [ "5.4" ], "nist_csf_2": [ "PR.AA-05" ], "academy_modules": [ "P7", "P15" ], "page": "https://openvapt.com/checks/HOST-USR-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/accounts.go", "source_file": "internal/checks/host/accounts.go" }, { "id": "HOST-USR-002", "title": "Accounts Without a Password", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "category": "Identity and Authentication", "effort": "low", "summary": "Checks /etc/shadow for accounts whose password field is empty.", "standards": { "cwe": [ "CWE-258", "CWE-521" ], "nist": [ "IA-5" ], "cis_topic": "User accounts: password fields are not empty", "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P7", "P15" ], "page": "https://openvapt.com/checks/HOST-USR-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/accounts.go", "source_file": "internal/checks/host/accounts.go" }, { "id": "HOST-USR-003", "title": "Sudo Rules Without Password (NOPASSWD)", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "category": "Identity and Authentication", "effort": "low", "summary": "Checks sudoers files for rules that grant root without asking for a password.", "standards": { "cwe": [ "CWE-306" ], "nist": [ "AC-6", "IA-11" ], "cis_topic": "Sudo: re-authentication for privilege escalation", "cis_v8": [ "5.4" ], "csf_2": [ "PR.AA-05" ] }, "cis_controls_v8": [ "5.4" ], "nist_csf_2": [ "PR.AA-05" ], "academy_modules": [ "F1", "P7", "P15" ], "page": "https://openvapt.com/checks/HOST-USR-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/accounts.go", "source_file": "internal/checks/host/accounts.go" }, { "id": "HOST-USR-004", "title": "Duplicate User IDs", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "category": "Identity and Authentication", "effort": "medium", "summary": "Checks that no two accounts share the same numeric user id.", "standards": { "cwe": [ "CWE-286" ], "nist": [ "AC-2", "IA-2" ], "cis_topic": "No duplicate UIDs", "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P7", "P15" ], "page": "https://openvapt.com/checks/HOST-USR-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/passwords.go", "source_file": "internal/checks/host/passwords.go" }, { "id": "HOST-USR-005", "title": "System Accounts With Login Shells", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "Checks that service accounts (UID below UID_MIN, usually 1000, other than root) cannot log in interactively.", "standards": { "cwe": [ "CWE-250" ], "nist": [ "AC-2", "CM-7" ], "cis_topic": "System accounts are secured", "cis_v8": [ "4.7" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "4.7" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P7", "P15" ], "page": "https://openvapt.com/checks/HOST-USR-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/passwords.go", "source_file": "internal/checks/host/passwords.go" }, { "id": "HOST-USR-006", "title": "Legacy NIS Entries in Account Files", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "Checks /etc/passwd, /etc/shadow and /etc/group for legacy '+' NIS inclusion entries.", "standards": { "cwe": [ "CWE-288" ], "nist": [ "IA-2", "CM-7" ], "cis_topic": "No legacy + entries", "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P7", "P15" ], "page": "https://openvapt.com/checks/HOST-USR-006.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/passwords.go", "source_file": "internal/checks/host/passwords.go" }, { "id": "HOST-USR-007", "title": "Insecure Trust Files in Home Directories", "domain": "host", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "Looks for .rhosts, .shosts and .netrc files in user home directories.", "standards": { "cwe": [ "CWE-256", "CWE-290" ], "nist": [ "IA-5", "CM-6" ], "cis_topic": "No .rhosts, .netrc files", "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P7", "P15" ], "page": "https://openvapt.com/checks/HOST-USR-007.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/passwords.go", "source_file": "internal/checks/host/passwords.go" }, { "id": "HOST-USR-008", "title": "Duplicate Group IDs or Account Names", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "category": "Identity and Authentication", "effort": "medium", "summary": "Checks /etc/group for duplicate GIDs and group names, and /etc/passwd for duplicate user names.", "standards": { "cwe": [ "CWE-286" ], "nist": [ "AC-2", "AC-3" ], "cis_topic": "No duplicate GIDs, group names or user names", "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P7", "P15", "P20" ], "page": "https://openvapt.com/checks/HOST-USR-008.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hygiene.go", "source_file": "internal/checks/host/hygiene.go" }, { "id": "HOST-USR-009", "title": "Password and Shadow Files Out of Step", "domain": "host", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "Checks that every /etc/passwd account has a /etc/shadow entry, that no password hash sits in /etc/passwd, and that /etc/shadow has no orphan entries.", "standards": { "cwe": [ "CWE-256", "CWE-522" ], "nist": [ "IA-5", "AC-2" ], "cis_topic": "passwd and shadow consistency", "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P7", "P15", "P20" ], "page": "https://openvapt.com/checks/HOST-USR-009.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hygiene.go", "source_file": "internal/checks/host/hygiene.go" }, { "id": "HOST-USR-010", "title": "Home Directories Accessible to Other Users", "domain": "host", "severity": "low", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "category": "Access Control", "effort": "low", "summary": "Checks that the home directory of each interactive account denies read, write and execute to others.", "standards": { "cwe": [ "CWE-732", "CWE-276" ], "nist": [ "AC-3", "AC-6" ], "cis_topic": "Home directory permissions", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P7", "P15", "P20" ], "page": "https://openvapt.com/checks/HOST-USR-010.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hygiene.go", "source_file": "internal/checks/host/hygiene.go" }, { "id": "NET-AI-001", "title": "AI Model Server or Dashboard Reachable From the Network", "domain": "network", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "category": "Network Exposure", "effort": "low", "summary": "Checks whether a self-hosted AI model server, AI web interface, AI cluster dashboard or vector database listens on a network-reachable address.", "standards": { "cwe": [ "CWE-306", "CWE-1327" ], "owasp": [ "A05:2021", "A07:2021" ], "nist": [ "SC-7", "CM-7", "AC-3" ], "cis_topic": "Expose applications only through a hardened front end", "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P24" ], "page": "https://openvapt.com/checks/NET-AI-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/ai_services.go", "source_file": "internal/checks/network/ai_services.go" }, { "id": "NET-AI-002", "title": "Jupyter Configuration Weakens Authentication", "domain": "network", "severity": "high", "cvss": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Identity and Authentication", "effort": "low", "summary": "Checks whether a Jupyter configuration blanks the login token without setting a password, or turns off cross-site request protection.", "standards": { "cwe": [ "CWE-306", "CWE-352" ], "owasp": [ "A07:2021", "A05:2021" ], "nist": [ "IA-2", "AC-3" ], "cis_topic": "Require authentication for administrative and code execution interfaces", "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P24" ], "page": "https://openvapt.com/checks/NET-AI-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/ai_services.go", "source_file": "internal/checks/network/ai_services.go" }, { "id": "NET-APP-001", "title": "Debugger or Application Control Ports Exposed", "domain": "network", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "category": "Network Exposure", "effort": "low", "summary": "Checks whether the Node.js inspector, Tomcat AJP or shutdown port, PHP-FPM FastCGI or Jupyter listen on network-reachable addresses.", "standards": { "cwe": [ "CWE-489", "CWE-1327" ], "owasp": [ "A05:2021" ], "nist": [ "SC-7", "CM-7" ], "cis_topic": "Expose applications only through a hardened front end", "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P13" ], "page": "https://openvapt.com/checks/NET-APP-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/firewall_exposure.go", "source_file": "internal/checks/network/firewall_exposure.go" }, { "id": "NET-APP-002", "title": "Application Server Ports Reachable Without a Reverse Proxy", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "category": "Network Exposure", "effort": "low", "summary": "Checks whether application servers and developer tools (Node.js, Tomcat, Django, Flask, Vite) serve HTTP on network-reachable addresses.", "standards": { "cwe": [ "CWE-1188", "CWE-1327" ], "owasp": [ "A05:2021" ], "nist": [ "SC-7", "CM-7" ], "cis_topic": "Expose applications only through a hardened front end", "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P13" ], "page": "https://openvapt.com/checks/NET-APP-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/firewall_exposure.go", "source_file": "internal/checks/network/firewall_exposure.go" }, { "id": "NET-DB-001", "title": "Database or Cache Service Exposed to the Network", "domain": "network", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Data Services", "effort": "low", "summary": "Checks whether databases, caches, search engines or the Docker API listen on a network-reachable address.", "standards": { "cwe": [ "CWE-1327", "CWE-306" ], "owasp": [ "A05:2021" ], "nist": [ "SC-7", "CM-7" ], "cis_topic": "Network exposure of data services", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "F1", "P3", "P8" ], "page": "https://openvapt.com/checks/NET-DB-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/listeners.go", "source_file": "internal/checks/network/listeners.go" }, { "id": "NET-DB-002", "title": "Redis Authentication and Network Binding", "domain": "network", "severity": "critical", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Data Services", "effort": "low", "summary": "Redis lacks protected mode, authentication, or a loopback-only bind.", "standards": { "cwe": [ "CWE-306", "CWE-1188" ], "owasp": [ "A05:2021" ], "nist": [ "AC-3", "CM-6", "SC-7" ], "cis_topic": "Secure data service configuration", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P3", "P8" ], "page": "https://openvapt.com/checks/NET-DB-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_services.go", "source_file": "internal/checks/network/data_services.go" }, { "id": "NET-DB-003", "title": "MongoDB Authorization and Network Binding", "domain": "network", "severity": "critical", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Data Services", "effort": "low", "summary": "MongoDB authorization is disabled or it binds beyond loopback.", "standards": { "cwe": [ "CWE-306", "CWE-1188" ], "owasp": [ "A05:2021" ], "nist": [ "AC-3", "CM-6", "SC-7" ], "cis_topic": "Secure data service configuration", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P3", "P8" ], "page": "https://openvapt.com/checks/NET-DB-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_services.go", "source_file": "internal/checks/network/data_services.go" }, { "id": "NET-DB-004", "title": "PostgreSQL Trust and Broad Client Access", "domain": "network", "severity": "critical", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Data Services", "effort": "low", "summary": "PostgreSQL accepts trust authentication or unrestricted client networks.", "standards": { "cwe": [ "CWE-306", "CWE-1188" ], "owasp": [ "A05:2021" ], "nist": [ "AC-3", "CM-6", "SC-7" ], "cis_topic": "Secure data service configuration", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P3", "P8" ], "page": "https://openvapt.com/checks/NET-DB-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_services.go", "source_file": "internal/checks/network/data_services.go" }, { "id": "NET-DB-005", "title": "MySQL or MariaDB Unsafe Network Options", "domain": "network", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Data Services", "effort": "low", "summary": "MySQL or MariaDB enables local file loading, skips grants, or listens broadly with networking enabled.", "standards": { "cwe": [ "CWE-306", "CWE-1188" ], "owasp": [ "A05:2021" ], "nist": [ "AC-3", "CM-6", "SC-7" ], "cis_topic": "Secure data service configuration", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P3", "P8" ], "page": "https://openvapt.com/checks/NET-DB-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_services.go", "source_file": "internal/checks/network/data_services.go" }, { "id": "NET-DB-006", "title": "Memcached UDP or Broad Listen Address", "domain": "network", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Data Services", "effort": "low", "summary": "Memcached enables UDP or listens on a non-loopback address.", "standards": { "cwe": [ "CWE-406", "CWE-1188" ], "owasp": [ "A05:2021" ], "nist": [ "SC-5", "CM-6", "SC-7" ], "cis_topic": "Secure data service configuration", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P3", "P8" ], "page": "https://openvapt.com/checks/NET-DB-006.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_services.go", "source_file": "internal/checks/network/data_services.go" }, { "id": "NET-DB-007", "title": "Elasticsearch Security and Network Binding", "domain": "network", "severity": "critical", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Data Services", "effort": "low", "summary": "Elasticsearch security is disabled or network.host is broadly reachable.", "standards": { "cwe": [ "CWE-306", "CWE-1188" ], "owasp": [ "A05:2021" ], "nist": [ "AC-3", "CM-6", "SC-7" ], "cis_topic": "Secure data service configuration", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P3", "P8" ], "page": "https://openvapt.com/checks/NET-DB-007.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_services.go", "source_file": "internal/checks/network/data_services.go" }, { "id": "NET-DB-008", "title": "Unsafe NFS Export Options", "domain": "network", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Data Services", "effort": "low", "summary": "NFS exports are world-accessible or use no_root_squash or insecure.", "standards": { "cwe": [ "CWE-732", "CWE-306" ], "owasp": [ "A05:2021" ], "nist": [ "AC-3", "CM-6", "SC-7" ], "cis_topic": "Secure data service configuration", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P3", "P8" ], "page": "https://openvapt.com/checks/NET-DB-008.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/services.go", "source_file": "internal/checks/network/services.go" }, { "id": "NET-DB-009", "title": "Unsafe Samba Guest or SMB1 Configuration", "domain": "network", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Data Services", "effort": "low", "summary": "Samba permits guest access, maps unknown users to guest, or allows SMB1.", "standards": { "cwe": [ "CWE-732", "CWE-306" ], "owasp": [ "A05:2021" ], "nist": [ "AC-3", "CM-6", "SC-7" ], "cis_topic": "Secure data service configuration", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P3", "P8" ], "page": "https://openvapt.com/checks/NET-DB-009.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/services.go", "source_file": "internal/checks/network/services.go" }, { "id": "NET-DB-010", "title": "BIND Open Recursion", "domain": "network", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "category": "Data Services", "effort": "low", "summary": "BIND enables recursion without restricting recursive clients.", "standards": { "cwe": [ "CWE-406" ], "owasp": [ "A05:2021" ], "nist": [ "SC-5", "CM-6", "SC-7" ], "cis_topic": "Secure data service configuration", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P3", "P8" ], "page": "https://openvapt.com/checks/NET-DB-010.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/services.go", "source_file": "internal/checks/network/services.go" }, { "id": "NET-DB-011", "title": "BIND Zone Transfers Allowed to Any", "domain": "network", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "category": "Data Services", "effort": "low", "summary": "BIND permits zone transfers to any client.", "standards": { "cwe": [ "CWE-497" ], "owasp": [ "A05:2021" ], "nist": [ "AC-3", "CM-6", "SC-7" ], "cis_topic": "Secure data service configuration", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P3", "P8" ], "page": "https://openvapt.com/checks/NET-DB-011.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/services.go", "source_file": "internal/checks/network/services.go" }, { "id": "NET-DB-012", "title": "Postfix Open Relay Controls", "domain": "network", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "category": "Data Services", "effort": "low", "summary": "Postfix relay restrictions are missing or mynetworks trusts overly broad ranges.", "standards": { "cwe": [ "CWE-441" ], "owasp": [ "A05:2021" ], "nist": [ "AC-3", "CM-6", "SC-7" ], "cis_topic": "Secure data service configuration", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P3", "P8" ], "page": "https://openvapt.com/checks/NET-DB-012.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/services.go", "source_file": "internal/checks/network/services.go" }, { "id": "NET-DB-013", "title": "Mail Cleartext Authentication Allowed", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "category": "Cryptography and TLS", "effort": "low", "summary": "Postfix or Dovecot permits plaintext authentication without requiring TLS.", "standards": { "cwe": [ "CWE-319", "CWE-523" ], "owasp": [ "A02:2021" ], "asvs": [ "9.1.1" ], "nist": [ "SC-8", "IA-5(1)" ], "cis_topic": "Secure data service configuration", "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P3", "P8" ], "page": "https://openvapt.com/checks/NET-DB-013.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/services.go", "source_file": "internal/checks/network/services.go" }, { "id": "NET-DB-014", "title": "MySQL Symbolic Links Allowed for Tables", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "category": "Data Services", "effort": "low", "summary": "MySQL or MariaDB does not disable symbolic links for table files (skip-symbolic-links or symbolic-links=0).", "standards": { "cwe": [ "CWE-59", "CWE-732" ], "owasp": [ "A05:2021" ], "asvs": [ "14.1.3" ], "nist": [ "CM-6", "AC-6" ], "cis_topic": "Database server hardening", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P3", "P8", "P19" ], "page": "https://openvapt.com/checks/NET-DB-014.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_depth.go", "source_file": "internal/checks/network/data_depth.go" }, { "id": "NET-DB-015", "title": "MySQL secure_file_priv Not Restricted", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "category": "Data Services", "effort": "low", "summary": "secure_file_priv is not set, or is set to an empty value, so LOAD DATA and SELECT ... INTO OUTFILE can read and write anywhere the server process can.", "standards": { "cwe": [ "CWE-73", "CWE-250" ], "owasp": [ "A05:2021" ], "asvs": [ "14.1.3" ], "nist": [ "CM-6", "AC-6", "SI-10" ], "cis_topic": "Database server hardening", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P3", "P8", "P19" ], "page": "https://openvapt.com/checks/NET-DB-015.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_depth.go", "source_file": "internal/checks/network/data_depth.go" }, { "id": "NET-DB-016", "title": "MySQL Does Not Require Encrypted Client Connections", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "category": "Cryptography and TLS", "effort": "low", "summary": "require_secure_transport is not ON, so clients may log in and query over plaintext TCP.", "standards": { "cwe": [ "CWE-319" ], "owasp": [ "A02:2021" ], "asvs": [ "9.2.2" ], "nist": [ "SC-8", "SC-13" ], "cis_topic": "Database transport encryption", "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P3", "P8", "P19" ], "page": "https://openvapt.com/checks/NET-DB-016.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_depth.go", "source_file": "internal/checks/network/data_depth.go" }, { "id": "NET-DB-017", "title": "MySQL Error Log Not Configured", "domain": "network", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "category": "Logging and Monitoring", "effort": "low", "summary": "log_error is not set, so server errors, failed logins and startup warnings go to the console or syslog without a dedicated, retained file.", "standards": { "cwe": [ "CWE-778" ], "owasp": [ "A09:2021" ], "asvs": [ "7.1.1" ], "nist": [ "AU-2", "AU-12" ], "cis_topic": "Database error logging", "cis_v8": [ "8.2" ], "csf_2": [ "PR.PS-04" ] }, "cis_controls_v8": [ "8.2" ], "nist_csf_2": [ "PR.PS-04" ], "academy_modules": [ "P3", "P8", "P19" ], "page": "https://openvapt.com/checks/NET-DB-017.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_depth.go", "source_file": "internal/checks/network/data_depth.go" }, { "id": "NET-DB-018", "title": "MySQL Resolves Client Host Names", "domain": "network", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "category": "Data Services", "effort": "low", "summary": "skip-name-resolve is not set, so grants that name hosts depend on DNS answers and every connection waits on a reverse lookup.", "standards": { "cwe": [ "CWE-350", "CWE-290" ], "owasp": [ "A05:2021" ], "asvs": [ "14.1.3" ], "nist": [ "CM-6", "IA-3" ], "cis_topic": "Database server hardening", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P3", "P8", "P19" ], "page": "https://openvapt.com/checks/NET-DB-018.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_depth.go", "source_file": "internal/checks/network/data_depth.go" }, { "id": "NET-DB-019", "title": "PostgreSQL Uses md5 or password Authentication", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "pg_hba.conf has active rules with the md5 or password method instead of scram-sha-256.", "standards": { "cwe": [ "CWE-328", "CWE-916" ], "owasp": [ "A02:2021", "A07:2021" ], "asvs": [ "2.4.1" ], "nist": [ "IA-5", "IA-5(1)", "SC-13" ], "cis_topic": "Database password hashing and authentication method", "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P3", "P8", "P19" ], "page": "https://openvapt.com/checks/NET-DB-019.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_depth.go", "source_file": "internal/checks/network/data_depth.go" }, { "id": "NET-DB-020", "title": "PostgreSQL SSL Not Enabled", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "category": "Cryptography and TLS", "effort": "low", "summary": "postgresql.conf does not set ssl = on, so TCP clients cannot encrypt their sessions and hostssl rules cannot apply.", "standards": { "cwe": [ "CWE-319" ], "owasp": [ "A02:2021" ], "asvs": [ "9.2.2" ], "nist": [ "SC-8", "SC-13" ], "cis_topic": "Database transport encryption", "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P3", "P8", "P19" ], "page": "https://openvapt.com/checks/NET-DB-020.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_depth.go", "source_file": "internal/checks/network/data_depth.go" }, { "id": "NET-DB-021", "title": "PostgreSQL Connection Logging Off", "domain": "network", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "category": "Logging and Monitoring", "effort": "low", "summary": "log_connections and log_disconnections are off, so successful logins leave no record.", "standards": { "cwe": [ "CWE-778" ], "owasp": [ "A09:2021" ], "asvs": [ "7.1.3" ], "nist": [ "AU-2", "AU-12", "AC-2(4)" ], "cis_topic": "Database connection logging", "cis_v8": [ "8.2" ], "csf_2": [ "PR.PS-04" ] }, "cis_controls_v8": [ "8.2" ], "nist_csf_2": [ "PR.PS-04" ], "academy_modules": [ "P3", "P8", "P19" ], "page": "https://openvapt.com/checks/NET-DB-021.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_depth.go", "source_file": "internal/checks/network/data_depth.go" }, { "id": "NET-DB-022", "title": "PostgreSQL Password Encryption Not SCRAM", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "category": "Identity and Authentication", "effort": "low", "summary": "password_encryption is set to md5, so new and changed passwords are stored as md5 verifiers that work as pass-the-hash credentials.", "standards": { "cwe": [ "CWE-916", "CWE-328" ], "owasp": [ "A02:2021" ], "asvs": [ "2.4.1" ], "nist": [ "IA-5(1)", "SC-13" ], "cis_topic": "Database password hashing", "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P3", "P8", "P19" ], "page": "https://openvapt.com/checks/NET-DB-022.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_depth.go", "source_file": "internal/checks/network/data_depth.go" }, { "id": "NET-DB-023", "title": "Redis Dangerous Commands Not Restricted", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "category": "Data Services", "effort": "low", "summary": "redis.conf neither renames nor disables CONFIG, FLUSHALL, FLUSHDB, DEBUG and KEYS, and no ACL user excludes the @dangerous category.", "standards": { "cwe": [ "CWE-749" ], "owasp": [ "A01:2021", "A05:2021" ], "asvs": [ "14.1.3" ], "nist": [ "AC-6", "CM-7" ], "cis_topic": "Data store administrative command restriction", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P3", "P8", "P19" ], "page": "https://openvapt.com/checks/NET-DB-023.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_depth.go", "source_file": "internal/checks/network/data_depth.go" }, { "id": "NET-DNS-001", "title": "BIND Version String Disclosed", "domain": "network", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "named.conf has no version statement in options, so a CHAOS class query for version.bind returns the exact BIND release.", "standards": { "cwe": [ "CWE-497" ], "owasp": [ "A05:2021" ], "nist": [ "CM-6", "SI-11" ], "cis_topic": "DNS server version disclosure", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P19" ], "page": "https://openvapt.com/checks/NET-DNS-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_depth.go", "source_file": "internal/checks/network/data_depth.go" }, { "id": "NET-DNS-002", "title": "BIND DNSSEC Validation Disabled", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "category": "Data Services", "effort": "low", "summary": "named.conf sets dnssec-validation no, so the resolver accepts forged answers for signed zones.", "standards": { "cwe": [ "CWE-347", "CWE-350" ], "owasp": [ "A08:2021" ], "nist": [ "SC-20", "SC-21" ], "cis_topic": "DNS resolver validation", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P19" ], "page": "https://openvapt.com/checks/NET-DNS-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_depth.go", "source_file": "internal/checks/network/data_depth.go" }, { "id": "NET-FW-001", "title": "No Active Host Firewall", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "category": "Network Exposure", "effort": "medium", "summary": "Checks whether a host firewall (nftables, iptables, ufw or firewalld) is filtering incoming traffic.", "standards": { "cwe": [ "CWE-923" ], "nist": [ "SC-7" ], "cis_topic": "Host-based firewall configured", "cis_v8": [ "4.4" ], "csf_2": [ "PR.IR-01" ] }, "cis_controls_v8": [ "4.4" ], "nist_csf_2": [ "PR.IR-01" ], "academy_modules": [ "F1", "P3" ], "page": "https://openvapt.com/checks/NET-FW-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/firewall.go", "source_file": "internal/checks/network/firewall.go" }, { "id": "NET-FW-002", "title": "IPv6 Listeners Without IPv6 Firewall", "domain": "network", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Network Exposure", "effort": "medium", "summary": "Network-reachable IPv6 listeners exist without a default-deny IPv6 firewall policy.", "standards": { "cwe": [ "CWE-923" ], "nist": [ "SC-7" ], "cis_v8": [ "4.4" ], "csf_2": [ "PR.IR-01" ] }, "cis_controls_v8": [ "4.4" ], "nist_csf_2": [ "PR.IR-01" ], "academy_modules": [ "P3" ], "page": "https://openvapt.com/checks/NET-FW-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/network_controls.go", "source_file": "internal/checks/network/network_controls.go" }, { "id": "NET-FW-003", "title": "Firewall Allows Sensitive Services From Anywhere", "domain": "network", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Network Exposure", "effort": "low", "summary": "Checks whether the host firewall explicitly opens a listening database, administrative or application server port to every address on the internet.", "standards": { "cwe": [ "CWE-923", "CWE-1327" ], "owasp": [ "A05:2021" ], "nist": [ "SC-7", "AC-4", "CM-7" ], "cis_topic": "Restrict firewall rules to required sources", "cis_v8": [ "4.4" ], "csf_2": [ "PR.IR-01" ] }, "cis_controls_v8": [ "4.4" ], "nist_csf_2": [ "PR.IR-01" ], "academy_modules": [ "P3", "P12" ], "page": "https://openvapt.com/checks/NET-FW-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/firewall_exposure.go", "source_file": "internal/checks/network/firewall_exposure.go" }, { "id": "NET-FW-004", "title": "Firewall Rules Open Ports With No Service", "domain": "network", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Network Exposure", "effort": "low", "summary": "Checks for firewall allow rules whose port has no listening service on this machine.", "standards": { "cwe": [ "CWE-1188" ], "nist": [ "SC-7", "CM-7", "CM-3" ], "cis_topic": "Review firewall rules periodically", "cis_v8": [ "4.4" ], "csf_2": [ "PR.IR-01" ] }, "cis_controls_v8": [ "4.4" ], "nist_csf_2": [ "PR.IR-01" ], "academy_modules": [ "P3", "P12" ], "page": "https://openvapt.com/checks/NET-FW-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/firewall_exposure.go", "source_file": "internal/checks/network/firewall_exposure.go" }, { "id": "NET-FW-005", "title": "Container Ports Bypass the Host Firewall", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "category": "Network Exposure", "effort": "medium", "summary": "Checks whether Docker publishes container ports through its own iptables chains with no DOCKER-USER filtering.", "standards": { "cwe": [ "CWE-923", "CWE-1327" ], "owasp": [ "A05:2021" ], "nist": [ "SC-7", "CM-7" ], "cis_topic": "Filter container traffic", "cis_v8": [ "4.4" ], "csf_2": [ "PR.IR-01" ] }, "cis_controls_v8": [ "4.4" ], "nist_csf_2": [ "PR.IR-01" ], "academy_modules": [ "P3", "P12" ], "page": "https://openvapt.com/checks/NET-FW-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/firewall_exposure.go", "source_file": "internal/checks/network/firewall_exposure.go" }, { "id": "NET-FW-006", "title": "Firewall Exposure Map of Listening Services", "domain": "network", "severity": "info", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N", "category": "Network Exposure", "effort": "low", "summary": "Shows, for every network-reachable listening socket, what the host firewall does with traffic to it.", "standards": { "cwe": [ "CWE-923" ], "nist": [ "CM-7", "CM-8", "SC-7" ], "cis_topic": "Network services inventory", "cis_v8": [ "4.4" ], "csf_2": [ "PR.IR-01" ] }, "cis_controls_v8": [ "4.4" ], "nist_csf_2": [ "PR.IR-01" ], "academy_modules": [ "P3", "P12" ], "page": "https://openvapt.com/checks/NET-FW-006.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/firewall_exposure.go", "source_file": "internal/checks/network/firewall_exposure.go" }, { "id": "NET-LSN-001", "title": "Inventory of Listening Network Services", "domain": "network", "severity": "info", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N", "category": "Network Exposure", "effort": "low", "summary": "Lists every TCP and UDP port this machine listens on, and whether it is reachable from other machines.", "standards": { "cwe": [ "CWE-1327" ], "nist": [ "CM-7", "CM-8" ], "cis_topic": "Network services inventory", "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "F2", "P3", "A1" ], "page": "https://openvapt.com/checks/NET-LSN-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/listeners.go", "source_file": "internal/checks/network/listeners.go" }, { "id": "NET-MAIL-001", "title": "Postfix SMTP TLS Not Offered or Has No Certificate", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "category": "Cryptography and TLS", "effort": "low", "summary": "smtpd_tls_security_level is none or unset, or is may or encrypt without a server certificate, so incoming SMTP sessions cannot be encrypted.", "standards": { "cwe": [ "CWE-319" ], "owasp": [ "A02:2021" ], "asvs": [ "9.2.2" ], "nist": [ "SC-8", "SC-13" ], "cis_topic": "Mail transport encryption", "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P19" ], "page": "https://openvapt.com/checks/NET-MAIL-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_depth.go", "source_file": "internal/checks/network/data_depth.go" }, { "id": "NET-MAIL-002", "title": "Postfix Allows TLS 1.0 or 1.1", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "category": "Cryptography and TLS", "effort": "low", "summary": "smtpd_tls_protocols or smtpd_tls_mandatory_protocols is unset or still allows TLSv1 or TLSv1.1.", "standards": { "cwe": [ "CWE-326", "CWE-327" ], "owasp": [ "A02:2021" ], "asvs": [ "9.1.3" ], "nist": [ "SC-8", "SC-13" ], "cis_topic": "TLS protocol versions", "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P19" ], "page": "https://openvapt.com/checks/NET-MAIL-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_depth.go", "source_file": "internal/checks/network/data_depth.go" }, { "id": "NET-MAIL-003", "title": "Postfix VRFY Command Enabled", "domain": "network", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "disable_vrfy_command is not yes, so anyone who connects can ask the server whether a mailbox exists.", "standards": { "cwe": [ "CWE-204" ], "owasp": [ "A05:2021" ], "nist": [ "CM-7", "SI-11" ], "cis_topic": "Mail server user enumeration", "cis_v8": [ "4.1" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "4.1" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P19" ], "page": "https://openvapt.com/checks/NET-MAIL-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_depth.go", "source_file": "internal/checks/network/data_depth.go" }, { "id": "NET-MAIL-004", "title": "Dovecot Does Not Require TLS", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "category": "Cryptography and TLS", "effort": "low", "summary": "Dovecot's ssl setting is yes or no instead of required, so IMAP and POP3 clients may use unencrypted sessions.", "standards": { "cwe": [ "CWE-319" ], "owasp": [ "A02:2021" ], "asvs": [ "9.2.2" ], "nist": [ "SC-8", "SC-13" ], "cis_topic": "Mail access encryption", "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P19" ], "page": "https://openvapt.com/checks/NET-MAIL-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_depth.go", "source_file": "internal/checks/network/data_depth.go" }, { "id": "NET-SVC-001", "title": "Cleartext Legacy Services Listening", "domain": "network", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "category": "Network Exposure", "effort": "medium", "summary": "Checks for Telnet, FTP, rsh/rlogin, TFTP, plain POP3/IMAP/LDAP, SNMP v1/v2c and rsync daemons on network-reachable addresses.", "standards": { "cwe": [ "CWE-319" ], "owasp": [ "A02:2021" ], "nist": [ "SC-8", "CM-7" ], "cis_topic": "Remove insecure legacy services", "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P3" ], "page": "https://openvapt.com/checks/NET-SVC-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/listeners.go", "source_file": "internal/checks/network/listeners.go" }, { "id": "NET-SVC-002", "title": "Control Plane or Remote Desktop Ports Network-Reachable", "domain": "network", "severity": "critical", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Network Exposure", "effort": "medium", "summary": "Docker API, Kubernetes API, kubelet, etcd, VNC or RDP listen on network-reachable addresses.", "standards": { "cwe": [ "CWE-1327", "CWE-923" ], "owasp": [ "A05:2021" ], "nist": [ "AC-17", "CM-7", "SC-7" ], "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P3", "P8" ], "page": "https://openvapt.com/checks/NET-SVC-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/services.go", "source_file": "internal/checks/network/services.go" }, { "id": "NET-SVC-003", "title": "Network Time Service Amplification Risk", "domain": "network", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "category": "Network Exposure", "effort": "low", "summary": "NTP or chrony serves broad clients or permits legacy monitoring commands that can amplify traffic.", "standards": { "cwe": [ "CWE-406" ], "nist": [ "SC-5", "SC-7" ], "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P3", "P8" ], "page": "https://openvapt.com/checks/NET-SVC-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/network_controls.go", "source_file": "internal/checks/network/network_controls.go" }, { "id": "NET-SVC-004", "title": "Management Panel or Monitoring Ports Network-Reachable", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "category": "Network Exposure", "effort": "low", "summary": "Webmin, cPanel, WHM, RabbitMQ Management, Consul, the Docker API with TLS or the Prometheus node exporter listen on network-reachable addresses.", "standards": { "cwe": [ "CWE-1188", "CWE-1327" ], "owasp": [ "A05:2021" ], "nist": [ "AC-17", "CM-7", "SC-7" ], "cis_v8": [ "4.8" ], "csf_2": [ "PR.PS-01", "PR.IR-01" ] }, "cis_controls_v8": [ "4.8" ], "nist_csf_2": [ "PR.PS-01", "PR.IR-01" ], "academy_modules": [ "P3" ], "page": "https://openvapt.com/checks/NET-SVC-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/services.go", "source_file": "internal/checks/network/services.go" }, { "id": "NET-TLS-001", "title": "Deprecated TLS 1.0 or 1.1 Accepted", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "category": "Cryptography and TLS", "effort": "low", "summary": "Checks whether local TLS services still accept TLS 1.0 or TLS 1.1.", "standards": { "cwe": [ "CWE-326", "CWE-327" ], "owasp": [ "A02:2021" ], "asvs": [ "9.1.3" ], "wstg": [ "WSTG-CRYP-01" ], "nist": [ "SC-8", "SC-13" ], "cis_topic": "TLS protocol versions", "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P4" ], "page": "https://openvapt.com/checks/NET-TLS-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/tls.go", "source_file": "internal/checks/network/tls.go" }, { "id": "NET-TLS-002", "title": "TLS Certificate Expired or Expiring Soon", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "category": "Cryptography and TLS", "effort": "low", "summary": "Checks the expiry date of the certificate each local TLS service presents.", "standards": { "cwe": [ "CWE-298" ], "owasp": [ "A02:2021" ], "asvs": [ "9.2.1" ], "wstg": [ "WSTG-CRYP-01" ], "nist": [ "SC-12", "SC-17" ], "cis_topic": "Certificate validity", "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P4" ], "page": "https://openvapt.com/checks/NET-TLS-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/tls.go", "source_file": "internal/checks/network/tls.go" }, { "id": "NET-TLS-003", "title": "Self-Signed or Mismatched TLS Certificate", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "category": "Cryptography and TLS", "effort": "low", "summary": "Checks whether each site presents a self-signed certificate, or one that does not cover its name.", "standards": { "cwe": [ "CWE-295", "CWE-297" ], "owasp": [ "A02:2021", "A07:2021" ], "asvs": [ "9.2.1" ], "wstg": [ "WSTG-CRYP-01" ], "nist": [ "SC-17" ], "cis_topic": "Certificate trust", "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P4" ], "page": "https://openvapt.com/checks/NET-TLS-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/tls.go", "source_file": "internal/checks/network/tls.go" }, { "id": "NET-TLS-004", "title": "Weak TLS 1.2 Cipher Suites Accepted", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "category": "Cryptography and TLS", "effort": "low", "summary": "A local TLS service accepts an RC4, 3DES, or CBC with SHA-1 cipher suite under TLS 1.2.", "standards": { "cwe": [ "CWE-326", "CWE-327" ], "owasp": [ "A02:2021" ], "asvs": [ "9.1.3" ], "wstg": [ "WSTG-CRYP-01" ], "nist": [ "SC-8", "SC-13" ], "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P4" ], "page": "https://openvapt.com/checks/NET-TLS-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/tls_depth.go", "source_file": "internal/checks/network/tls_depth.go" }, { "id": "NET-TLS-005", "title": "TLS Certificate Public Key Too Small", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "category": "Cryptography and TLS", "effort": "medium", "summary": "A TLS leaf certificate uses RSA below 2048 bits or an elliptic curve below 256 bits.", "standards": { "cwe": [ "CWE-326" ], "owasp": [ "A02:2021" ], "wstg": [ "WSTG-CRYP-01" ], "nist": [ "SC-12", "SC-13" ], "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P4" ], "page": "https://openvapt.com/checks/NET-TLS-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/tls_depth.go", "source_file": "internal/checks/network/tls_depth.go" }, { "id": "NET-TLS-006", "title": "SHA-1 Signed TLS Leaf Certificate", "domain": "network", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "category": "Cryptography and TLS", "effort": "medium", "summary": "A TLS leaf certificate is signed using SHA-1.", "standards": { "cwe": [ "CWE-327" ], "owasp": [ "A02:2021" ], "wstg": [ "WSTG-CRYP-01" ], "nist": [ "SC-12", "SC-13" ], "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P4" ], "page": "https://openvapt.com/checks/NET-TLS-006.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/tls_depth.go", "source_file": "internal/checks/network/tls_depth.go" }, { "id": "WEB-APA-001", "title": "Apache Reveals Version in Header and Footer", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "ServerTokens is not Prod or ServerSignature is On, so responses and error pages show the Apache version and modules.", "standards": { "cwe": [ "CWE-497" ], "owasp": [ "A05:2021" ], "asvs": [ "14.3.3" ], "wstg": [ "WSTG-INFO-02" ], "nist": [ "CM-6", "SI-11" ], "cis_topic": "Web server banner and version disclosure", "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P18" ], "page": "https://openvapt.com/checks/WEB-APA-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go", "source_file": "internal/checks/web/serverconf.go" }, { "id": "WEB-APA-002", "title": "Apache TRACE Method Enabled", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "TraceEnable is not set to Off, so the HTTP TRACE method echoes requests back to the client.", "standards": { "cwe": [ "CWE-1188", "CWE-749" ], "owasp": [ "A05:2021" ], "asvs": [ "14.5.1" ], "wstg": [ "WSTG-CONF-06" ], "nist": [ "CM-7" ], "cis_topic": "HTTP methods allowed by the web server", "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P18" ], "page": "https://openvapt.com/checks/WEB-APA-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go", "source_file": "internal/checks/web/serverconf.go" }, { "id": "WEB-APA-003", "title": "Apache Directory Indexes Enabled in Configuration", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "An Options directive enables Indexes (or All), so folders without an index page list their files.", "standards": { "cwe": [ "CWE-548" ], "owasp": [ "A01:2021", "A05:2021" ], "asvs": [ "4.3.2" ], "wstg": [ "WSTG-CONF-04" ], "nist": [ "CM-7", "AC-3" ], "cis_topic": "Web server directory listing", "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P18" ], "page": "https://openvapt.com/checks/WEB-APA-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go", "source_file": "internal/checks/web/serverconf.go" }, { "id": "WEB-APA-004", "title": "Apache AllowOverride All Permits .htaccess Control", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "A Directory block sets AllowOverride All, so any .htaccess file under it can change handlers, options and access rules.", "standards": { "cwe": [ "CWE-15", "CWE-1188" ], "owasp": [ "A05:2021" ], "asvs": [ "14.1.1" ], "wstg": [ "WSTG-CONF-05" ], "nist": [ "CM-6", "CM-7" ], "cis_topic": "Web server per-directory override scope", "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P18" ], "page": "https://openvapt.com/checks/WEB-APA-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go", "source_file": "internal/checks/web/serverconf.go" }, { "id": "WEB-APA-005", "title": "Apache Allows TLS 1.0 or 1.1", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "category": "Cryptography and TLS", "effort": "low", "summary": "SSLProtocol permits SSLv3, TLSv1 or TLSv1.1, or is not set on a TLS-enabled server (the default all -SSLv3 allows TLS 1.0 and 1.1).", "standards": { "cwe": [ "CWE-326", "CWE-327" ], "owasp": [ "A02:2021" ], "asvs": [ "9.1.3" ], "wstg": [ "WSTG-CRYP-01" ], "nist": [ "SC-8", "SC-13" ], "cis_topic": "TLS protocol versions", "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P18" ], "page": "https://openvapt.com/checks/WEB-APA-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go", "source_file": "internal/checks/web/serverconf.go" }, { "id": "WEB-APA-006", "title": "Apache Cipher Suite Includes Weak Suites", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "category": "Cryptography and TLS", "effort": "low", "summary": "SSLCipherSuite includes NULL, export, DES or 3DES, RC4, MD5, anonymous or other legacy suites, or SSLHonorCipherOrder forces a legacy order.", "standards": { "cwe": [ "CWE-327" ], "owasp": [ "A02:2021" ], "asvs": [ "9.1.2" ], "wstg": [ "WSTG-CRYP-01" ], "nist": [ "SC-8", "SC-13" ], "cis_topic": "TLS cipher suites", "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P18" ], "page": "https://openvapt.com/checks/WEB-APA-006.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go", "source_file": "internal/checks/web/serverconf.go" }, { "id": "WEB-APA-007", "title": "Apache OCSP Stapling Not Enabled", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Cryptography and TLS", "effort": "low", "summary": "A TLS-enabled Apache does not set SSLUseStapling on.", "standards": { "cwe": [ "CWE-299" ], "owasp": [ "A02:2021" ], "asvs": [ "9.2.4" ], "wstg": [ "WSTG-CRYP-01" ], "nist": [ "SC-8", "SC-17" ], "cis_topic": "Certificate status checking", "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P18" ], "page": "https://openvapt.com/checks/WEB-APA-007.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go", "source_file": "internal/checks/web/serverconf.go" }, { "id": "WEB-APA-008", "title": "Apache Has No Request Filtering Module", "domain": "web", "severity": "info", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Neither mod_security (ModSecurity) nor mod_evasive is loaded, so Apache has no request filtering or flood control in front of the application.", "standards": { "cwe": [ "CWE-1188" ], "owasp": [ "A05:2021" ], "asvs": [ "11.1.4" ], "nist": [ "SC-5", "SI-10" ], "cis_topic": "Web application filtering", "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P18", "P25" ], "page": "https://openvapt.com/checks/WEB-APA-008.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go", "source_file": "internal/checks/web/serverconf.go" }, { "id": "WEB-APA-009", "title": "Apache ETag Reveals Inode Numbers", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "FileETag includes INode (or All), so ETag headers leak filesystem inode numbers of served files.", "standards": { "cwe": [ "CWE-497" ], "owasp": [ "A05:2021" ], "asvs": [ "14.3.3" ], "wstg": [ "WSTG-INFO-02" ], "nist": [ "SI-11", "CM-6" ], "cis_topic": "Web server information disclosure in headers", "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P18" ], "page": "https://openvapt.com/checks/WEB-APA-009.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go", "source_file": "internal/checks/web/serverconf.go" }, { "id": "WEB-APA-010", "title": "Apache Serves Repository and Environment Files", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "No DirectoryMatch, FilesMatch or RedirectMatch rule denies .git, .svn, .hg or .env paths, so they are served if present under a document root.", "standards": { "cwe": [ "CWE-538", "CWE-527" ], "owasp": [ "A05:2021" ], "asvs": [ "12.5.1", "14.3.3" ], "wstg": [ "WSTG-CONF-04" ], "nist": [ "CM-7", "SC-28" ], "cis_topic": "Web server access to hidden files", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P18" ], "page": "https://openvapt.com/checks/WEB-APA-010.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go", "source_file": "internal/checks/web/serverconf.go" }, { "id": "WEB-APA-011", "title": "Apache Has No Slow Request Protection", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "category": "Secure Configuration", "effort": "low", "summary": "mod_reqtimeout does not appear to be loaded and no RequestReadTimeout is set, so a client that sends its request very slowly can hold a worker for the whole Timeout.", "standards": { "cwe": [ "CWE-770" ], "owasp": [ "A05:2021" ], "nist": [ "SC-5", "CM-6" ], "cis_topic": "Web server request time limits", "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P18", "P25" ], "page": "https://openvapt.com/checks/WEB-APA-011.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go", "source_file": "internal/checks/web/serverconf.go" }, { "id": "WEB-APP-001", "title": "Laravel Debug Mode On or Application Key Missing", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks Laravel .env files for APP_DEBUG=true or an empty APP_KEY.", "standards": { "cwe": [ "CWE-489", "CWE-209", "CWE-321" ], "owasp": [ "A05:2021" ], "asvs": [ "14.3.2", "2.10.4" ], "wstg": [ "WSTG-CONF-02", "WSTG-ERRH-01" ], "nist": [ "CM-6", "SI-11", "IA-5" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "A6" ], "page": "https://openvapt.com/checks/WEB-APP-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/frameworks.go", "source_file": "internal/checks/web/frameworks.go" }, { "id": "WEB-APP-002", "title": "Application .env File Readable by All Users", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "category": "Access Control", "effort": "low", "summary": "Checks the permission bits of framework .env files for world-read access.", "standards": { "cwe": [ "CWE-732", "CWE-312" ], "owasp": [ "A05:2021", "A02:2021" ], "asvs": [ "14.1.3" ], "wstg": [ "WSTG-CONF-09" ], "nist": [ "AC-3", "SC-28" ], "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "A6" ], "page": "https://openvapt.com/checks/WEB-APP-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/frameworks.go", "source_file": "internal/checks/web/frameworks.go" }, { "id": "WEB-APP-003", "title": "Symfony Running in the Development Environment", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks Symfony .env files for APP_ENV=dev or APP_DEBUG=1.", "standards": { "cwe": [ "CWE-489", "CWE-215" ], "owasp": [ "A05:2021" ], "asvs": [ "14.3.2" ], "wstg": [ "WSTG-CONF-02", "WSTG-ERRH-01" ], "nist": [ "CM-6", "SI-11" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "A6" ], "page": "https://openvapt.com/checks/WEB-APP-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/frameworks.go", "source_file": "internal/checks/web/frameworks.go" }, { "id": "WEB-APP-004", "title": "Rails Master Key or Secrets File Exposed", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "category": "Access Control", "effort": "low", "summary": "Checks Rails config/master.key, credentials key files and secrets.yml for world-read permissions or a location inside a web root.", "standards": { "cwe": [ "CWE-732", "CWE-312", "CWE-321" ], "owasp": [ "A02:2021", "A05:2021" ], "asvs": [ "2.10.4", "14.1.3" ], "wstg": [ "WSTG-CONF-09" ], "nist": [ "AC-3", "SC-28", "IA-5" ], "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "A6" ], "page": "https://openvapt.com/checks/WEB-APP-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/frameworks.go", "source_file": "internal/checks/web/frameworks.go" }, { "id": "WEB-APP-005", "title": "Rails Production Does Not Force HTTPS", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "category": "Web Application Security", "effort": "low", "summary": "Checks config/environments/production.rb for config.force_ssl = true.", "standards": { "cwe": [ "CWE-319", "CWE-614" ], "owasp": [ "A02:2021", "A05:2021" ], "asvs": [ "9.1.1", "3.4.1" ], "wstg": [ "WSTG-CRYP-03" ], "nist": [ "SC-8", "CM-6" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "A6" ], "page": "https://openvapt.com/checks/WEB-APP-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/frameworks.go", "source_file": "internal/checks/web/frameworks.go" }, { "id": "WEB-APP-006", "title": "Spring Boot Actuator Endpoints Fully Exposed", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks Spring Boot application properties for management.endpoints.web.exposure.include=* and probes the local site for an open /actuator/env.", "standards": { "cwe": [ "CWE-306", "CWE-497" ], "owasp": [ "A05:2021", "A01:2021" ], "asvs": [ "14.3.2", "4.3.2" ], "wstg": [ "WSTG-CONF-02", "WSTG-CONF-05" ], "nist": [ "CM-7", "AC-3", "SI-11" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "A6" ], "page": "https://openvapt.com/checks/WEB-APP-006.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/frameworks.go", "source_file": "internal/checks/web/frameworks.go" }, { "id": "WEB-APP-007", "title": "Flask Debug Mode Enabled in Application Code", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Looks for app.run(debug=True) or app.debug = True in Flask entry files. A heuristic; the service check WEB-PY-004 covers the environment switches.", "standards": { "cwe": [ "CWE-489", "CWE-215" ], "owasp": [ "A05:2021" ], "asvs": [ "14.3.2" ], "wstg": [ "WSTG-CONF-02" ], "nist": [ "CM-6", "CM-7" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "A6" ], "page": "https://openvapt.com/checks/WEB-APP-007.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/frameworks.go", "source_file": "internal/checks/web/frameworks.go" }, { "id": "WEB-APP-008", "title": "Dependency Lock Files Older Than a Year", "domain": "web", "severity": "info", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N", "category": "Patch and Vulnerability Management", "effort": "medium", "summary": "Reports composer.lock, package-lock.json, yarn.lock, Gemfile.lock and poetry.lock files not modified for 365 days or more (dependency freshness). Informational.", "standards": { "cwe": [ "CWE-1104", "CWE-1395" ], "owasp": [ "A06:2021" ], "asvs": [ "14.2.1" ], "nist": [ "SI-2", "SA-22" ], "cis_v8": [ "7.4" ], "csf_2": [ "ID.RA-01", "PR.PS-02" ] }, "cis_controls_v8": [ "7.4" ], "nist_csf_2": [ "ID.RA-01", "PR.PS-02" ], "academy_modules": [ "A6" ], "page": "https://openvapt.com/checks/WEB-APP-008.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/frameworks.go", "source_file": "internal/checks/web/frameworks.go" }, { "id": "WEB-APP-009", "title": "Git Repository Stored Inside a Web Root", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Looks on disk for a .git folder directly inside each web document root.", "standards": { "cwe": [ "CWE-527", "CWE-538" ], "owasp": [ "A05:2021" ], "asvs": [ "12.5.1" ], "wstg": [ "WSTG-CONF-04" ], "nist": [ "CM-7", "SC-28" ], "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "A6" ], "page": "https://openvapt.com/checks/WEB-APP-009.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/frameworks.go", "source_file": "internal/checks/web/frameworks.go" }, { "id": "WEB-APP-010", "title": "Framework Writable Folders Open to All Users", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "category": "Access Control", "effort": "low", "summary": "Checks Laravel and Symfony cache, log and storage folders for world-write permission.", "standards": { "cwe": [ "CWE-732", "CWE-94" ], "owasp": [ "A05:2021" ], "asvs": [ "14.1.3" ], "wstg": [ "WSTG-CONF-09" ], "nist": [ "AC-3", "AC-6", "CM-5" ], "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "A6" ], "page": "https://openvapt.com/checks/WEB-APP-010.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/frameworks.go", "source_file": "internal/checks/web/frameworks.go" }, { "id": "WEB-CK-001", "title": "Cookies Missing Secure, HttpOnly or SameSite", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "category": "Web Application Security", "effort": "medium", "summary": "Checks the security flags on cookies the home page sets.", "standards": { "cwe": [ "CWE-614", "CWE-1004", "CWE-1275" ], "owasp": [ "A05:2021", "A07:2021" ], "asvs": [ "3.4.1", "3.4.2", "3.4.3" ], "wstg": [ "WSTG-SESS-02" ], "nist": [ "SC-8", "SC-23" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P5" ], "page": "https://openvapt.com/checks/WEB-CK-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/transport.go", "source_file": "internal/checks/web/transport.go" }, { "id": "WEB-CMS-001", "title": "WordPress Version Disclosed", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks whether WordPress sites reveal their exact version in the page or in readme.html.", "standards": { "cwe": [ "CWE-497" ], "owasp": [ "A05:2021", "A06:2021" ], "asvs": [ "14.3.3" ], "wstg": [ "WSTG-INFO-08" ], "nist": [ "CM-7", "SI-11" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6", "P14" ], "page": "https://openvapt.com/checks/WEB-CMS-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cms.go", "source_file": "internal/checks/web/cms.go" }, { "id": "WEB-CMS-002", "title": "WordPress XML-RPC Interface Enabled", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "category": "Web Application Security", "effort": "low", "summary": "Checks whether xmlrpc.php answers on WordPress sites.", "standards": { "cwe": [ "CWE-307" ], "owasp": [ "A07:2021" ], "asvs": [ "2.2.1" ], "nist": [ "AC-7", "CM-7" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6", "P14" ], "page": "https://openvapt.com/checks/WEB-CMS-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cms.go", "source_file": "internal/checks/web/cms.go" }, { "id": "WEB-CMS-003", "title": "WordPress User Accounts Enumerable", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks whether the WordPress REST API lists user accounts to anonymous visitors.", "standards": { "cwe": [ "CWE-204" ], "owasp": [ "A07:2021" ], "wstg": [ "WSTG-IDNT-04" ], "nist": [ "CM-6", "SI-11" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6", "P14" ], "page": "https://openvapt.com/checks/WEB-CMS-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/exposure.go", "source_file": "internal/checks/web/exposure.go" }, { "id": "WEB-CMS-004", "title": "CMS Configuration Readable by All Users", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "category": "Access Control", "effort": "low", "summary": "Checks whether wp-config.php, Joomla configuration.php or Drupal settings.php can be read by every local user.", "standards": { "cwe": [ "CWE-732", "CWE-260" ], "owasp": [ "A05:2021" ], "wstg": [ "WSTG-CONF-09" ], "nist": [ "AC-3", "SC-28" ], "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P6", "P14" ], "page": "https://openvapt.com/checks/WEB-CMS-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cms_more.go", "source_file": "internal/checks/web/cms_more.go" }, { "id": "WEB-CMS-005", "title": "CMS Configuration Writable by Other Users", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "category": "Access Control", "effort": "low", "summary": "Checks whether wp-config.php, Joomla configuration.php or Drupal settings.php is group- or world-writable.", "standards": { "cwe": [ "CWE-732" ], "owasp": [ "A05:2021" ], "wstg": [ "WSTG-CONF-09" ], "nist": [ "AC-3", "CM-5" ], "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P6", "P14" ], "page": "https://openvapt.com/checks/WEB-CMS-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cms_more.go", "source_file": "internal/checks/web/cms_more.go" }, { "id": "WEB-CMS-006", "title": "WordPress Shows Debug Output to Visitors", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks wp-config.php for WP_DEBUG enabled without WP_DEBUG_DISPLAY set to false.", "standards": { "cwe": [ "CWE-209", "CWE-489" ], "owasp": [ "A05:2021" ], "asvs": [ "14.3.2" ], "wstg": [ "WSTG-ERRH-01" ], "nist": [ "SI-11" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6", "P14" ], "page": "https://openvapt.com/checks/WEB-CMS-006.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cms_more.go", "source_file": "internal/checks/web/cms_more.go" }, { "id": "WEB-CMS-007", "title": "WordPress Dashboard File Editor Enabled", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks whether wp-config.php leaves the built-in theme and plugin file editor enabled.", "standards": { "cwe": [ "CWE-94", "CWE-1188" ], "owasp": [ "A05:2021" ], "nist": [ "CM-7", "AC-6" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6", "P14" ], "page": "https://openvapt.com/checks/WEB-CMS-007.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cms_more.go", "source_file": "internal/checks/web/cms_more.go" }, { "id": "WEB-CMS-008", "title": "WordPress Automatic Updates Disabled", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "category": "Patch and Vulnerability Management", "effort": "low", "summary": "Checks whether wp-config.php turns off WordPress background updates, including security releases.", "standards": { "cwe": [ "CWE-1104" ], "owasp": [ "A06:2021" ], "asvs": [ "14.2.1" ], "nist": [ "SI-2" ], "cis_v8": [ "7.4" ], "csf_2": [ "ID.RA-01", "PR.PS-02" ] }, "cis_controls_v8": [ "7.4" ], "nist_csf_2": [ "ID.RA-01", "PR.PS-02" ], "academy_modules": [ "P6", "P14" ], "page": "https://openvapt.com/checks/WEB-CMS-008.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cms_more.go", "source_file": "internal/checks/web/cms_more.go" }, { "id": "WEB-CMS-009", "title": "Joomla Debug or Verbose Error Reporting Enabled", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks Joomla configuration.php for debug mode or maximum/development error reporting.", "standards": { "cwe": [ "CWE-209", "CWE-489" ], "owasp": [ "A05:2021" ], "asvs": [ "14.3.2" ], "wstg": [ "WSTG-ERRH-01" ], "nist": [ "SI-11" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6", "P14" ], "page": "https://openvapt.com/checks/WEB-CMS-009.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cms_more.go", "source_file": "internal/checks/web/cms_more.go" }, { "id": "WEB-CMS-010", "title": "Joomla Version Disclosed", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks whether a Joomla site serves its version manifest at /administrator/manifests/files/joomla.xml.", "standards": { "cwe": [ "CWE-497" ], "owasp": [ "A05:2021", "A06:2021" ], "asvs": [ "14.3.3" ], "wstg": [ "WSTG-INFO-08" ], "nist": [ "SI-11" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6", "P14" ], "page": "https://openvapt.com/checks/WEB-CMS-010.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cms_more.go", "source_file": "internal/checks/web/cms_more.go" }, { "id": "WEB-CMS-011", "title": "Drupal Version Disclosed by Changelog", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks whether a Drupal site serves CHANGELOG.txt, which names the exact Drupal version.", "standards": { "cwe": [ "CWE-497" ], "owasp": [ "A05:2021", "A06:2021" ], "asvs": [ "14.3.3" ], "wstg": [ "WSTG-INFO-08" ], "nist": [ "SI-11" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6", "P14" ], "page": "https://openvapt.com/checks/WEB-CMS-011.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cms_more.go", "source_file": "internal/checks/web/cms_more.go" }, { "id": "WEB-CMS-012", "title": "Drupal Core Past End of Life", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Patch and Vulnerability Management", "effort": "high", "summary": "Reads the installed Drupal core version from disk and compares its major release with the Drupal security coverage dates.", "standards": { "cwe": [ "CWE-1104" ], "owasp": [ "A06:2021" ], "asvs": [ "14.2.1" ], "nist": [ "SI-2", "SA-22" ], "cis_v8": [ "2.2" ], "csf_2": [ "ID.RA-01", "PR.PS-02" ] }, "cis_controls_v8": [ "2.2" ], "nist_csf_2": [ "ID.RA-01", "PR.PS-02" ], "academy_modules": [ "P6", "P14", "A6" ], "page": "https://openvapt.com/checks/WEB-CMS-012.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cms_depth.go", "source_file": "internal/checks/web/cms_depth.go" }, { "id": "WEB-CMS-013", "title": "Drupal Trusted Host Patterns Not Set", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "category": "Web Application Security", "effort": "low", "summary": "Checks Drupal settings.php for the trusted_host_patterns setting.", "standards": { "cwe": [ "CWE-644", "CWE-346" ], "owasp": [ "A05:2021" ], "asvs": [ "14.4.1" ], "wstg": [ "WSTG-INPV-17" ], "nist": [ "CM-6", "SI-10" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6", "P14", "A6" ], "page": "https://openvapt.com/checks/WEB-CMS-013.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cms_depth.go", "source_file": "internal/checks/web/cms_depth.go" }, { "id": "WEB-CMS-014", "title": "Joomla Core Past End of Life", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Patch and Vulnerability Management", "effort": "high", "summary": "Reads the installed Joomla version from administrator/manifests/files/joomla.xml on disk and compares it with the Joomla support dates.", "standards": { "cwe": [ "CWE-1104" ], "owasp": [ "A06:2021" ], "asvs": [ "14.2.1" ], "nist": [ "SI-2", "SA-22" ], "cis_v8": [ "2.2" ], "csf_2": [ "ID.RA-01", "PR.PS-02" ] }, "cis_controls_v8": [ "2.2" ], "nist_csf_2": [ "ID.RA-01", "PR.PS-02" ], "academy_modules": [ "P6", "P14", "A6" ], "page": "https://openvapt.com/checks/WEB-CMS-014.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cms_depth.go", "source_file": "internal/checks/web/cms_depth.go" }, { "id": "WEB-CMS-015", "title": "Magento Not in Production Mode", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks app/etc/env.php for a MAGE_MODE other than production.", "standards": { "cwe": [ "CWE-489", "CWE-209" ], "owasp": [ "A05:2021" ], "asvs": [ "14.3.2" ], "wstg": [ "WSTG-CONF-02", "WSTG-ERRH-01" ], "nist": [ "CM-6", "SI-11" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6", "P14", "A6" ], "page": "https://openvapt.com/checks/WEB-CMS-015.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cms_depth.go", "source_file": "internal/checks/web/cms_depth.go" }, { "id": "WEB-CMS-016", "title": "Ghost Configured With a Plain HTTP Site URL", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "category": "Web Application Security", "effort": "low", "summary": "Checks Ghost config.production.json for a url that starts with http://.", "standards": { "cwe": [ "CWE-319" ], "owasp": [ "A02:2021", "A05:2021" ], "asvs": [ "9.1.1" ], "wstg": [ "WSTG-CRYP-03" ], "nist": [ "SC-8", "CM-6" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6", "P14", "A6" ], "page": "https://openvapt.com/checks/WEB-CMS-016.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cms_depth.go", "source_file": "internal/checks/web/cms_depth.go" }, { "id": "WEB-CMS-017", "title": "WordPress Cron Reachable by Visitors", "domain": "web", "severity": "info", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Reports whether /wp-cron.php answers to anonymous requests on WordPress sites. Informational.", "standards": { "cwe": [ "CWE-770" ], "owasp": [ "A05:2021" ], "wstg": [ "WSTG-CONF-05" ], "nist": [ "CM-7", "SC-5" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6", "P14", "A6" ], "page": "https://openvapt.com/checks/WEB-CMS-017.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cms_depth.go", "source_file": "internal/checks/web/cms_depth.go" }, { "id": "WEB-CMS-018", "title": "WordPress Author Archive Reveals Login Names", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks whether /?author=1 redirects to an author archive, which exposes the first account's login name in the address.", "standards": { "cwe": [ "CWE-204" ], "owasp": [ "A07:2021" ], "wstg": [ "WSTG-IDNT-04" ], "nist": [ "CM-6", "SI-11" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6", "P14", "A6" ], "page": "https://openvapt.com/checks/WEB-CMS-018.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cms_depth.go", "source_file": "internal/checks/web/cms_depth.go" }, { "id": "WEB-CMS-019", "title": "Drupal update.php Open Without Authentication", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "category": "Secure Configuration", "effort": "low", "summary": "Checks Drupal settings.php for $settings['update_free_access'] = TRUE.", "standards": { "cwe": [ "CWE-306" ], "owasp": [ "A01:2021", "A05:2021" ], "asvs": [ "4.3.2" ], "wstg": [ "WSTG-CONF-05" ], "nist": [ "AC-3", "CM-6" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6", "P14", "A6" ], "page": "https://openvapt.com/checks/WEB-CMS-019.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cms_depth.go", "source_file": "internal/checks/web/cms_depth.go" }, { "id": "WEB-COR-001", "title": "Cross-Origin Resource Sharing Allows Any Origin With Credentials", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "category": "Web Application Security", "effort": "low", "summary": "Checks the home page's CORS headers for a wildcard origin combined with credentials, or an origin of null.", "standards": { "cwe": [ "CWE-942" ], "owasp": [ "A05:2021", "A01:2021" ], "asvs": [ "14.5.3" ], "wstg": [ "WSTG-CLNT-07" ], "nist": [ "AC-4", "CM-6" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P5" ], "page": "https://openvapt.com/checks/WEB-COR-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/docroot.go", "source_file": "internal/checks/web/docroot.go" }, { "id": "WEB-CVE-001", "title": "Vulnerable Web Application Libraries", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Patch and Vulnerability Management", "effort": "medium", "summary": "Matches local web library versions against offline OSV advisories; WordPress core is inventoried and reported Incomplete because OSV publishes no WordPress feed.", "standards": { "cwe": [ "CWE-1104" ], "owasp": [ "A06:2021" ], "asvs": [ "14.2.1" ], "nist": [ "SI-2", "RA-5" ], "cis_v8": [ "7.4" ], "csf_2": [ "ID.RA-01", "PR.PS-02" ] }, "cis_controls_v8": [ "7.4" ], "nist_csf_2": [ "ID.RA-01", "PR.PS-02" ], "academy_modules": [ "P10", "A7" ], "page": "https://openvapt.com/checks/WEB-CVE-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cve.go", "source_file": "internal/checks/web/cve.go" }, { "id": "WEB-DOC-001", "title": "Secrets or Backups Stored Inside a Web Root", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Looks on disk inside each web document root for environment files, database dumps, backups, archives and private keys.", "standards": { "cwe": [ "CWE-530", "CWE-538", "CWE-312" ], "owasp": [ "A05:2021" ], "asvs": [ "12.5.1" ], "wstg": [ "WSTG-CONF-04" ], "nist": [ "SC-28", "CM-6" ], "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P6" ], "page": "https://openvapt.com/checks/WEB-DOC-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/docroot.go", "source_file": "internal/checks/web/docroot.go" }, { "id": "WEB-DOC-002", "title": "Web Root Files Writable by Other Users", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "category": "Access Control", "effort": "low", "summary": "Looks for world-writable files inside web document roots.", "standards": { "cwe": [ "CWE-732" ], "owasp": [ "A05:2021" ], "wstg": [ "WSTG-CONF-09" ], "nist": [ "AC-3", "AC-6" ], "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P6" ], "page": "https://openvapt.com/checks/WEB-DOC-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/docroot.go", "source_file": "internal/checks/web/docroot.go" }, { "id": "WEB-DOC-003", "title": "Archives or Certificates Inside a Web Root", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Lists archives (*.tar.gz, *.tgz, *.tar, *.7z) and certificate files (*.pem, *.crt) inside each web document root for review, outside download folders.", "standards": { "cwe": [ "CWE-538", "CWE-552" ], "owasp": [ "A05:2021" ], "asvs": [ "12.5.1" ], "wstg": [ "WSTG-CONF-04" ], "nist": [ "SC-28", "CM-6" ], "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P6" ], "page": "https://openvapt.com/checks/WEB-DOC-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/docroot.go", "source_file": "internal/checks/web/docroot.go" }, { "id": "WEB-EXP-001", "title": "Git Repository Exposed on the Website", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks whether the .git folder can be downloaded from each site.", "standards": { "cwe": [ "CWE-527", "CWE-538" ], "owasp": [ "A05:2021" ], "asvs": [ "12.5.1" ], "wstg": [ "WSTG-CONF-04" ], "nist": [ "CM-7", "SC-28" ], "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P6" ], "page": "https://openvapt.com/checks/WEB-EXP-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/exposure.go", "source_file": "internal/checks/web/exposure.go" }, { "id": "WEB-EXP-002", "title": "Environment or Secrets File Exposed", "domain": "web", "severity": "critical", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Information Exposure", "effort": "medium", "summary": "Checks whether .env and similar configuration files can be downloaded.", "standards": { "cwe": [ "CWE-538", "CWE-260" ], "owasp": [ "A05:2021" ], "asvs": [ "14.3.2", "2.10.4" ], "wstg": [ "WSTG-CONF-04" ], "nist": [ "CM-7", "SC-28" ], "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P6" ], "page": "https://openvapt.com/checks/WEB-EXP-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/exposure.go", "source_file": "internal/checks/web/exposure.go" }, { "id": "WEB-EXP-003", "title": "PHP Information Page Exposed", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks for phpinfo() pages left on the site.", "standards": { "cwe": [ "CWE-497" ], "owasp": [ "A05:2021" ], "asvs": [ "14.3.2" ], "nist": [ "CM-7", "SI-11" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6" ], "page": "https://openvapt.com/checks/WEB-EXP-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/exposure.go", "source_file": "internal/checks/web/exposure.go" }, { "id": "WEB-EXP-004", "title": "Backup or Database Dump Files Downloadable", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks for common backup archives and SQL dumps left in the web root.", "standards": { "cwe": [ "CWE-530" ], "owasp": [ "A05:2021" ], "asvs": [ "12.5.1" ], "wstg": [ "WSTG-CONF-04" ], "nist": [ "CM-7", "SC-28" ], "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P6" ], "page": "https://openvapt.com/checks/WEB-EXP-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/exposure.go", "source_file": "internal/checks/web/exposure.go" }, { "id": "WEB-EXP-005", "title": "Directory Listing Enabled", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks whether the web server lists folder contents when there is no index page.", "standards": { "cwe": [ "CWE-548" ], "owasp": [ "A01:2021", "A05:2021" ], "asvs": [ "4.3.2" ], "wstg": [ "WSTG-CONF-04" ], "nist": [ "CM-7", "AC-3" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6" ], "page": "https://openvapt.com/checks/WEB-EXP-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/exposure.go", "source_file": "internal/checks/web/exposure.go" }, { "id": "WEB-EXP-006", "title": "Web Server Status Page Exposed", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks whether Apache server-status/server-info or nginx stub_status are reachable for each site.", "standards": { "cwe": [ "CWE-497" ], "owasp": [ "A05:2021" ], "asvs": [ "14.3.2" ], "nist": [ "CM-7", "SI-11" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6" ], "page": "https://openvapt.com/checks/WEB-EXP-006.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/exposure.go", "source_file": "internal/checks/web/exposure.go" }, { "id": "WEB-EXP-007", "title": "Other Version Control Metadata Exposed", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks for exposed Subversion, Mercurial and Bazaar metadata folders.", "standards": { "cwe": [ "CWE-527" ], "owasp": [ "A05:2021" ], "asvs": [ "12.5.1" ], "wstg": [ "WSTG-CONF-04" ], "nist": [ "CM-7", "SC-28" ], "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P6" ], "page": "https://openvapt.com/checks/WEB-EXP-007.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/exposure.go", "source_file": "internal/checks/web/exposure.go" }, { "id": "WEB-EXP-008", "title": "Log Files Downloadable From the Website", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks for application and debug logs published under the web root.", "standards": { "cwe": [ "CWE-532", "CWE-538" ], "owasp": [ "A09:2021", "A05:2021" ], "asvs": [ "12.5.1" ], "wstg": [ "WSTG-CONF-04" ], "nist": [ "CM-7", "SC-28" ], "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P6" ], "page": "https://openvapt.com/checks/WEB-EXP-008.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/exposure.go", "source_file": "internal/checks/web/exposure.go" }, { "id": "WEB-EXP-009", "title": "Dependency Manifests Exposed", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks whether package manifests and lock files are downloadable.", "standards": { "cwe": [ "CWE-538" ], "owasp": [ "A05:2021", "A06:2021" ], "asvs": [ "12.5.1" ], "wstg": [ "WSTG-CONF-04" ], "nist": [ "CM-7" ], "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P6" ], "page": "https://openvapt.com/checks/WEB-EXP-009.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/exposure.go", "source_file": "internal/checks/web/exposure.go" }, { "id": "WEB-EXP-010", "title": "Default Web Server Page Served", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks whether a site shows the web server's default installation page.", "standards": { "cwe": [ "CWE-1188", "CWE-497" ], "owasp": [ "A05:2021" ], "wstg": [ "WSTG-INFO-02", "WSTG-CONF-02" ], "nist": [ "CM-7" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6" ], "page": "https://openvapt.com/checks/WEB-EXP-010.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/exposure.go", "source_file": "internal/checks/web/exposure.go" }, { "id": "WEB-EXP-011", "title": "Database Administration Tool Exposed", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks whether phpMyAdmin or Adminer login pages are publicly reachable.", "standards": { "cwe": [ "CWE-1188", "CWE-306" ], "owasp": [ "A05:2021", "A07:2021" ], "wstg": [ "WSTG-CONF-05" ], "nist": [ "CM-7", "AC-3" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6" ], "page": "https://openvapt.com/checks/WEB-EXP-011.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/exposure.go", "source_file": "internal/checks/web/exposure.go" }, { "id": "WEB-EXP-012", "title": "Framework Debug Pages Exposed", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks for development debug tools and verbose error pages left enabled in production.", "standards": { "cwe": [ "CWE-489", "CWE-209" ], "owasp": [ "A05:2021" ], "asvs": [ "14.3.2", "7.4.1" ], "wstg": [ "WSTG-ERRH-01", "WSTG-CONF-02" ], "nist": [ "CM-7", "SI-11" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6" ], "page": "https://openvapt.com/checks/WEB-EXP-012.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/exposure.go", "source_file": "internal/checks/web/exposure.go" }, { "id": "WEB-HDR-001", "title": "Missing HTTP Strict Transport Security (HSTS)", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "category": "Web Application Security", "effort": "low", "summary": "Checks that HTTPS sites tell browsers to always use HTTPS, for at least six months.", "standards": { "cwe": [ "CWE-319", "CWE-523" ], "owasp": [ "A05:2021" ], "asvs": [ "14.4.5" ], "wstg": [ "WSTG-CONF-07" ], "nist": [ "SC-8" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P4", "A8" ], "page": "https://openvapt.com/checks/WEB-HDR-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/headers.go", "source_file": "internal/checks/web/headers.go" }, { "id": "WEB-HDR-002", "title": "Missing Content Security Policy", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "category": "Web Application Security", "effort": "medium", "summary": "Checks that each site sends a Content-Security-Policy header.", "standards": { "cwe": [ "CWE-1021", "CWE-79" ], "owasp": [ "A03:2021", "A05:2021" ], "asvs": [ "14.4.3" ], "wstg": [ "WSTG-CONF-12" ], "nist": [ "SI-10" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P5", "A8" ], "page": "https://openvapt.com/checks/WEB-HDR-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/headers.go", "source_file": "internal/checks/web/headers.go" }, { "id": "WEB-HDR-003", "title": "Site Can Be Framed (Clickjacking)", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "category": "Web Application Security", "effort": "low", "summary": "Checks that each site forbids being embedded in other sites' frames.", "standards": { "cwe": [ "CWE-1021" ], "owasp": [ "A04:2021" ], "asvs": [ "14.4.7" ], "wstg": [ "WSTG-CLNT-09" ], "nist": [ "SC-18" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P5", "A8" ], "page": "https://openvapt.com/checks/WEB-HDR-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/headers.go", "source_file": "internal/checks/web/headers.go" }, { "id": "WEB-HDR-004", "title": "Missing X-Content-Type-Options", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "category": "Web Application Security", "effort": "low", "summary": "Checks that browsers are told not to guess (sniff) content types.", "standards": { "cwe": [ "CWE-430" ], "owasp": [ "A05:2021" ], "asvs": [ "14.4.4" ], "nist": [ "CM-6" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P5", "A8" ], "page": "https://openvapt.com/checks/WEB-HDR-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/headers.go", "source_file": "internal/checks/web/headers.go" }, { "id": "WEB-HDR-005", "title": "Missing Referrer-Policy", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "category": "Web Application Security", "effort": "low", "summary": "Checks that each site limits what URL information is leaked to other sites in the Referer header.", "standards": { "cwe": [ "CWE-201" ], "owasp": [ "A05:2021" ], "asvs": [ "14.4.6" ], "nist": [ "CM-6" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P5", "A8" ], "page": "https://openvapt.com/checks/WEB-HDR-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/headers.go", "source_file": "internal/checks/web/headers.go" }, { "id": "WEB-HDR-006", "title": "Missing Permissions-Policy", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "category": "Web Application Security", "effort": "low", "summary": "Checks that each site restricts powerful browser features (camera, microphone, geolocation) it does not use.", "standards": { "cwe": [ "CWE-1188" ], "owasp": [ "A05:2021" ], "nist": [ "CM-6", "CM-7" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P5", "A8" ], "page": "https://openvapt.com/checks/WEB-HDR-006.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/headers.go", "source_file": "internal/checks/web/headers.go" }, { "id": "WEB-HDR-007", "title": "Server Software Version Disclosed", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks whether response headers reveal exact web server, PHP or framework versions.", "standards": { "cwe": [ "CWE-497" ], "owasp": [ "A05:2021" ], "asvs": [ "14.3.3" ], "wstg": [ "WSTG-INFO-02" ], "nist": [ "CM-7", "SI-11" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6", "A8" ], "page": "https://openvapt.com/checks/WEB-HDR-007.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/headers.go", "source_file": "internal/checks/web/headers.go" }, { "id": "WEB-NGX-001", "title": "nginx Version Shown in Server Header", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "nginx does not set server_tokens off, so responses and error pages carry the exact nginx version.", "standards": { "cwe": [ "CWE-497" ], "owasp": [ "A05:2021" ], "asvs": [ "14.3.3" ], "wstg": [ "WSTG-INFO-02" ], "nist": [ "CM-6", "SI-11" ], "cis_topic": "Web server banner and version disclosure", "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P18" ], "page": "https://openvapt.com/checks/WEB-NGX-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go", "source_file": "internal/checks/web/serverconf.go" }, { "id": "WEB-NGX-002", "title": "nginx Directory Listing Enabled in Configuration", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "An nginx server or location block sets autoindex on.", "standards": { "cwe": [ "CWE-548" ], "owasp": [ "A01:2021", "A05:2021" ], "asvs": [ "4.3.2" ], "wstg": [ "WSTG-CONF-04" ], "nist": [ "CM-7", "AC-3" ], "cis_topic": "Web server directory listing", "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P18" ], "page": "https://openvapt.com/checks/WEB-NGX-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go", "source_file": "internal/checks/web/serverconf.go" }, { "id": "WEB-NGX-003", "title": "nginx Allows TLS 1.0 or 1.1", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "category": "Cryptography and TLS", "effort": "low", "summary": "ssl_protocols lists SSLv3, TLSv1 or TLSv1.1, or is not set on a TLS-enabled server, so the allowed version depends on the nginx build.", "standards": { "cwe": [ "CWE-326", "CWE-327" ], "owasp": [ "A02:2021" ], "asvs": [ "9.1.3" ], "wstg": [ "WSTG-CRYP-01" ], "nist": [ "SC-8", "SC-13" ], "cis_topic": "TLS protocol versions", "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P18" ], "page": "https://openvapt.com/checks/WEB-NGX-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go", "source_file": "internal/checks/web/serverconf.go" }, { "id": "WEB-NGX-004", "title": "nginx Cipher List Includes Weak Suites", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "category": "Cryptography and TLS", "effort": "low", "summary": "ssl_ciphers includes NULL, export, DES or 3DES, RC4, MD5, anonymous or other legacy suites, or ssl_prefer_server_ciphers forces a legacy order.", "standards": { "cwe": [ "CWE-327" ], "owasp": [ "A02:2021" ], "asvs": [ "9.1.2" ], "wstg": [ "WSTG-CRYP-01" ], "nist": [ "SC-8", "SC-13" ], "cis_topic": "TLS cipher suites", "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P18" ], "page": "https://openvapt.com/checks/WEB-NGX-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go", "source_file": "internal/checks/web/serverconf.go" }, { "id": "WEB-NGX-005", "title": "nginx OCSP Stapling Off or Session Tickets On", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Cryptography and TLS", "effort": "low", "summary": "A TLS-enabled nginx does not enable ssl_stapling, or leaves ssl_session_tickets on.", "standards": { "cwe": [ "CWE-299", "CWE-326" ], "owasp": [ "A02:2021" ], "asvs": [ "9.2.4" ], "wstg": [ "WSTG-CRYP-01" ], "nist": [ "SC-8", "SC-17" ], "cis_topic": "Certificate status checking and session resumption", "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P18" ], "page": "https://openvapt.com/checks/WEB-NGX-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go", "source_file": "internal/checks/web/serverconf.go" }, { "id": "WEB-NGX-006", "title": "nginx Request Limits Not Configured", "domain": "web", "severity": "info", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "nginx sets no client_max_body_size, limit_req_zone or limit_conn_zone, so request size and rate rely on defaults alone.", "standards": { "cwe": [ "CWE-770", "CWE-307" ], "owasp": [ "A05:2021", "A07:2021" ], "asvs": [ "11.1.4" ], "nist": [ "SC-5", "AC-7" ], "cis_topic": "Web server request limits", "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P18", "P25" ], "page": "https://openvapt.com/checks/WEB-NGX-006.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go", "source_file": "internal/checks/web/serverconf.go" }, { "id": "WEB-NGX-007", "title": "nginx Serves Hidden Files and Folders", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "No location block denies paths that begin with a dot, so .git, .env, .svn and .htaccess files under the document root are served if present.", "standards": { "cwe": [ "CWE-538", "CWE-527" ], "owasp": [ "A05:2021" ], "asvs": [ "12.5.1", "14.3.3" ], "wstg": [ "WSTG-CONF-04" ], "nist": [ "CM-7", "SC-28" ], "cis_topic": "Web server access to hidden files", "cis_v8": [ "3.3" ], "csf_2": [ "PR.AA-05", "PR.DS-01" ] }, "cis_controls_v8": [ "3.3" ], "nist_csf_2": [ "PR.AA-05", "PR.DS-01" ], "academy_modules": [ "P18" ], "page": "https://openvapt.com/checks/WEB-NGX-007.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go", "source_file": "internal/checks/web/serverconf.go" }, { "id": "WEB-NODE-001", "title": "Node.js Version Past End of Life", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Patch and Vulnerability Management", "effort": "high", "summary": "Checks whether the installed Node.js runtime is a release line that no longer receives security fixes.", "standards": { "cwe": [ "CWE-1104" ], "owasp": [ "A06:2021" ], "asvs": [ "14.2.1" ], "nist": [ "SI-2", "SA-22" ], "cis_topic": "Use supported software", "cis_v8": [ "2.2" ], "csf_2": [ "ID.RA-01", "PR.PS-02" ] }, "cis_controls_v8": [ "2.2" ], "nist_csf_2": [ "ID.RA-01", "PR.PS-02" ], "academy_modules": [ "P13" ], "page": "https://openvapt.com/checks/WEB-NODE-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/runtimes.go", "source_file": "internal/checks/web/runtimes.go" }, { "id": "WEB-NODE-002", "title": "Node.js Debugger (Inspector) Enabled in a Service", "domain": "web", "severity": "critical", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Secure Configuration", "effort": "low", "summary": "Checks whether a Node.js service is started with --inspect, which opens the V8 debugger.", "standards": { "cwe": [ "CWE-489", "CWE-306" ], "owasp": [ "A05:2021" ], "asvs": [ "14.3.2" ], "nist": [ "CM-7", "CM-6" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P13" ], "page": "https://openvapt.com/checks/WEB-NODE-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/runtimes.go", "source_file": "internal/checks/web/runtimes.go" }, { "id": "WEB-NODE-003", "title": "Node.js Service Not Running in Production Mode", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks whether Node.js services set NODE_ENV=production.", "standards": { "cwe": [ "CWE-489", "CWE-209" ], "owasp": [ "A05:2021" ], "asvs": [ "14.3.2" ], "nist": [ "CM-6" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P13" ], "page": "https://openvapt.com/checks/WEB-NODE-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/runtimes.go", "source_file": "internal/checks/web/runtimes.go" }, { "id": "WEB-PHP-001", "title": "PHP Displays Errors to Visitors", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Secure Configuration", "effort": "low", "summary": "Checks whether PHP prints error messages into web pages.", "standards": { "cwe": [ "CWE-209" ], "owasp": [ "A05:2021" ], "asvs": [ "14.3.2" ], "wstg": [ "WSTG-ERRH-01" ], "nist": [ "SI-11", "CM-6" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6" ], "page": "https://openvapt.com/checks/WEB-PHP-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/php.go", "source_file": "internal/checks/web/php.go" }, { "id": "WEB-PHP-002", "title": "PHP Version Exposed in Headers", "domain": "web", "severity": "low", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks whether PHP adds an X-Powered-By header with its version.", "standards": { "cwe": [ "CWE-497" ], "owasp": [ "A05:2021" ], "asvs": [ "14.3.3" ], "wstg": [ "WSTG-INFO-02" ], "nist": [ "CM-7", "SI-11" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6" ], "page": "https://openvapt.com/checks/WEB-PHP-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/php.go", "source_file": "internal/checks/web/php.go" }, { "id": "WEB-PHP-003", "title": "PHP Allows Remote File Inclusion", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Secure Configuration", "effort": "low", "summary": "Checks whether include() and require() may load code from URLs.", "standards": { "cwe": [ "CWE-98" ], "owasp": [ "A03:2021", "A05:2021" ], "asvs": [ "12.3.3" ], "nist": [ "CM-6", "CM-7" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P6" ], "page": "https://openvapt.com/checks/WEB-PHP-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/php.go", "source_file": "internal/checks/web/php.go" }, { "id": "WEB-PHP-004", "title": "PHP Version Past End of Security Support", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Patch and Vulnerability Management", "effort": "high", "summary": "Checks whether the installed PHP branch still receives security fixes from the PHP project.", "standards": { "cwe": [ "CWE-1104" ], "owasp": [ "A06:2021" ], "asvs": [ "14.2.1" ], "nist": [ "SI-2" ], "cis_v8": [ "2.2" ], "csf_2": [ "ID.RA-01", "PR.PS-02" ] }, "cis_controls_v8": [ "2.2" ], "nist_csf_2": [ "ID.RA-01", "PR.PS-02" ], "academy_modules": [ "F3", "P6" ], "page": "https://openvapt.com/checks/WEB-PHP-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/php.go", "source_file": "internal/checks/web/php.go" }, { "id": "WEB-PHP-005", "title": "PHP Session Cookies Not Hardened", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "category": "Web Application Security", "effort": "low", "summary": "Checks PHP's session settings: HttpOnly and SameSite cookies and strict session id mode.", "standards": { "cwe": [ "CWE-1004", "CWE-384" ], "owasp": [ "A07:2021" ], "asvs": [ "3.4.2", "3.2.1" ], "wstg": [ "WSTG-SESS-02", "WSTG-SESS-03" ], "nist": [ "SC-23", "CM-6" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P5", "P6" ], "page": "https://openvapt.com/checks/WEB-PHP-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/php.go", "source_file": "internal/checks/web/php.go" }, { "id": "WEB-PY-001", "title": "Django Debug Mode Enabled", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks Django settings files for DEBUG = True with no production override.", "standards": { "cwe": [ "CWE-489", "CWE-215" ], "owasp": [ "A05:2021" ], "asvs": [ "14.3.2" ], "wstg": [ "WSTG-ERRH-01" ], "nist": [ "CM-6" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P13" ], "page": "https://openvapt.com/checks/WEB-PY-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/runtimes.go", "source_file": "internal/checks/web/runtimes.go" }, { "id": "WEB-PY-002", "title": "Django Accepts Any Host Header", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "category": "Web Application Security", "effort": "low", "summary": "Checks Django settings for ALLOWED_HOSTS = ['*'].", "standards": { "cwe": [ "CWE-346" ], "owasp": [ "A05:2021" ], "wstg": [ "WSTG-INPV-17" ], "nist": [ "CM-6", "SI-10" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P13" ], "page": "https://openvapt.com/checks/WEB-PY-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/runtimes.go", "source_file": "internal/checks/web/runtimes.go" }, { "id": "WEB-PY-003", "title": "Django Uses the Generated Development Secret Key", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "category": "Cryptography and TLS", "effort": "low", "summary": "Checks Django settings for a SECRET_KEY that starts with django-insecure-, the marker of the key generated by startproject.", "standards": { "cwe": [ "CWE-798", "CWE-321" ], "owasp": [ "A02:2021", "A05:2021" ], "asvs": [ "2.10.4" ], "nist": [ "IA-5", "SC-12" ], "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P13" ], "page": "https://openvapt.com/checks/WEB-PY-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/runtimes.go", "source_file": "internal/checks/web/runtimes.go" }, { "id": "WEB-PY-004", "title": "Python Interactive Debugger Enabled in a Service", "domain": "web", "severity": "critical", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Secure Configuration", "effort": "low", "summary": "Checks whether a service runs Flask or Werkzeug with the interactive debugger enabled.", "standards": { "cwe": [ "CWE-489", "CWE-94" ], "owasp": [ "A05:2021" ], "asvs": [ "14.3.2" ], "nist": [ "CM-7", "CM-6" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P13" ], "page": "https://openvapt.com/checks/WEB-PY-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/runtimes.go", "source_file": "internal/checks/web/runtimes.go" }, { "id": "WEB-PY-005", "title": "Python Development Server Used in a Service", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "category": "Secure Configuration", "effort": "medium", "summary": "Checks whether a service runs a development web server such as manage.py runserver, flask run or python -m http.server.", "standards": { "cwe": [ "CWE-489", "CWE-1188" ], "owasp": [ "A05:2021" ], "asvs": [ "14.3.2" ], "nist": [ "CM-7" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P13" ], "page": "https://openvapt.com/checks/WEB-PY-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/runtimes.go", "source_file": "internal/checks/web/runtimes.go" }, { "id": "WEB-SEC-001", "title": "No security.txt Contact File", "domain": "web", "severity": "info", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N", "category": "Web Application Security", "effort": "low", "summary": "Checks whether each site publishes /.well-known/security.txt (RFC 9116).", "standards": { "cwe": [ "CWE-1188" ], "nist": [ "RA-5(11)" ], "cis_v8": [ "16.2" ], "csf_2": [ "ID.RA-08" ] }, "cis_controls_v8": [ "16.2" ], "nist_csf_2": [ "ID.RA-08" ], "academy_modules": [ "P5" ], "page": "https://openvapt.com/checks/WEB-SEC-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/docroot.go", "source_file": "internal/checks/web/docroot.go" }, { "id": "WEB-TLS-001", "title": "Site Available Over Plain HTTP Without Redirect", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "category": "Cryptography and TLS", "effort": "low", "summary": "Checks that every site redirects http:// requests to https://.", "standards": { "cwe": [ "CWE-319" ], "owasp": [ "A02:2021" ], "asvs": [ "9.1.1" ], "wstg": [ "WSTG-CRYP-01" ], "nist": [ "SC-8" ], "cis_v8": [ "3.10" ], "csf_2": [ "PR.DS-02" ] }, "cis_controls_v8": [ "3.10" ], "nist_csf_2": [ "PR.DS-02" ], "academy_modules": [ "P4" ], "page": "https://openvapt.com/checks/WEB-TLS-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/transport.go", "source_file": "internal/checks/web/transport.go" }, { "id": "WEB-TOM-001", "title": "Tomcat Manager Reachable Without Address Restriction", "domain": "web", "severity": "high", "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Web Application Security", "effort": "low", "summary": "Checks whether the Tomcat Manager or Host Manager application is deployed without an address filter limiting it to localhost.", "standards": { "cwe": [ "CWE-1188", "CWE-923" ], "owasp": [ "A01:2021", "A05:2021" ], "wstg": [ "WSTG-CONF-05" ], "nist": [ "AC-3", "CM-7" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P13" ], "page": "https://openvapt.com/checks/WEB-TOM-001.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/tomcat.go", "source_file": "internal/checks/web/tomcat.go" }, { "id": "WEB-TOM-002", "title": "Tomcat Administrative Users With Default or Weak Passwords", "domain": "web", "severity": "critical", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Identity and Authentication", "effort": "low", "summary": "Checks tomcat-users.xml for manager or admin accounts with well-known default passwords, passwords equal to the user name, or short passwords.", "standards": { "cwe": [ "CWE-1392", "CWE-521", "CWE-256" ], "owasp": [ "A07:2021" ], "asvs": [ "2.1.1", "2.5.4" ], "wstg": [ "WSTG-ATHN-02" ], "nist": [ "IA-5" ], "cis_v8": [ "5.2" ], "csf_2": [ "PR.AA-01" ] }, "cis_controls_v8": [ "5.2" ], "nist_csf_2": [ "PR.AA-01" ], "academy_modules": [ "P13" ], "page": "https://openvapt.com/checks/WEB-TOM-002.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/tomcat.go", "source_file": "internal/checks/web/tomcat.go" }, { "id": "WEB-TOM-003", "title": "Tomcat Shutdown Port Uses the Default Command", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "category": "Secure Configuration", "effort": "low", "summary": "Checks whether Tomcat's shutdown port is enabled with the well-known default command SHUTDOWN.", "standards": { "cwe": [ "CWE-1188" ], "owasp": [ "A05:2021" ], "nist": [ "CM-6", "CM-7" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P13" ], "page": "https://openvapt.com/checks/WEB-TOM-003.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/tomcat.go", "source_file": "internal/checks/web/tomcat.go" }, { "id": "WEB-TOM-004", "title": "Tomcat AJP Connector Unprotected (Ghostcat)", "domain": "web", "severity": "critical", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "category": "Web Application Security", "effort": "low", "summary": "Checks for an active AJP connector that has no shared secret and is not bound to loopback, or that disables the secret requirement.", "standards": { "cwe": [ "CWE-306", "CWE-1327" ], "owasp": [ "A05:2021", "A06:2021" ], "nist": [ "SC-7", "AC-3", "CM-7" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P13" ], "page": "https://openvapt.com/checks/WEB-TOM-004.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/tomcat.go", "source_file": "internal/checks/web/tomcat.go" }, { "id": "WEB-TOM-005", "title": "Tomcat Example and Documentation Applications Deployed", "domain": "web", "severity": "medium", "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "category": "Information Exposure", "effort": "low", "summary": "Checks whether the examples or docs web applications that ship with Tomcat are deployed.", "standards": { "cwe": [ "CWE-1188" ], "owasp": [ "A05:2021" ], "wstg": [ "WSTG-CONF-02" ], "nist": [ "CM-7" ], "cis_v8": [ "16.7" ], "csf_2": [ "PR.PS-01" ] }, "cis_controls_v8": [ "16.7" ], "nist_csf_2": [ "PR.PS-01" ], "academy_modules": [ "P13" ], "page": "https://openvapt.com/checks/WEB-TOM-005.html", "source": "https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/tomcat.go", "source_file": "internal/checks/web/tomcat.go" } ] }