documentation_complete: true

title: 'Configure Java Security Manager To Use An Environment Policy'

description: |-
    The Java Security Manager is a crucial piece of the Java
    security infrastructure. JBoss Fuse should be configured to load a Java
    security policy that has been vetted for use in the environment.

rationale: |-
    A weak, default, or incomplete Java Security Manager policy file can
    completely compromise the security of a Java installation by granting
    excessive permissions to applications running within the sandbox. These
    permissions can be leveraged (maliciously or not) to run code against the
    operating system.

severity: medium

identifiers:
    cce: ""

references:
    cis: ""
    disa: ""
    nist: SA-13

ocil_clause: 'no policy file exists or has been configured'
