documentation_complete: true

title: 'Secure or Remove Web Console'

description: |-
    The Web Console application must be secured so it is
    accessible by trusted administrators only. If this condition is not met,
    the application must be removed (deleted) from deployment.

rationale: |-
    Failure to secure the default consoles against unauthorized access can
    quickly lead to system compromise. The default consoles included with JBoss
    are a well-known attack vector that can be leveraged to load malicious code
    to be executed on the server.

severity: high

identifiers:
    cce: ""

references:
    cis: ""
    disa: ""
    nist: AC-3

ocil_clause: 'the web console is not secure or removed'
