name	cis-tomcat8-v110-10.13
description	Do not run applications as privileged (Automated)
category	cis-tomcat
version	1.1.0
author	cyberstrike-official
tags	["cis","tomcat","linux","java","configuration","hardening","security"]
cis_id	10.13
cis_benchmark	CIS Apache Tomcat 8 Benchmark v1.1.0
tech_stack	["linux","tomcat","java"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

10.13 Do not run applications as privileged (Automated)

Setting the privileged attribute for an application changes the class loader to the Server class loader instead of the Shared class loader.

Running an application in privileged mode allows an application to load the manager libraries.

Ensure the privileged attribute in each context.xml file does not exist or is set to false.

# find . -name context.xml | xargs grep "privileged"

Set the privileged attribute in all context.xml files to false unless it is required as for the manager application:

<Context ... privileged="false" />

By default, privileged has a value of false.

Controls Version	Control	IG 1	IG 2	IG 3
v8	5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user's primary, non-privileged account.	●	●	●
v7	4 Controlled Use of Administrative Privileges Controlled Use of Administrative Privileges

Level 1

cis-tomcat8-v110-10-13