documentation_complete: true

title: 'Secure or Disable JMX Access'

description: |-
    JMX access must be secured so it is accessible by trusted
    administrators only. If this condition is not met, the access must be
    disabled from the deployment.

rationale: |-
    Failure to secure JMX against unauthorized access can quickly lead to
    system compromise. The default access included with JBoss is a well-known
    attack vector that can be leveraged to load malicious code to be executed
    on the server.

severity: high

identifiers:
    cce: ""

references:
    cis: ""
    disa: ""
    nist: AC-3

ocil_clause: 'JMX access is not secured or disabled'
