V-255856
SV-255856r960963_rule
CAT II
The WebSphere Application Server process must not be started from the command line with the -password option.
From: IBM WebSphere Traditional V9.x Security Technical Implementation Guide (V2R1)
Description
<VulnDiscussion>The use of the -password option to launch a WebSphere process from the command line can result in a security exposure. Password information may become visible to any user with the ability to view system processes. For example, on a Linux system the "ps" command will display all running processes, which would include all of the command line flags used to start a WebSphere process.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
Check Procedure
Review System Security Plan documentation.
Interview the system administrator.
Access operating system to list commands currently running.
For UNIX: run "ps -ef | grep -i wsadmin.sh"
For windows: from a DOS prompt as admin user run "WMIC path win32_process where "caption='wsadmin.exe'" get CommandLine"
If the results show "wsadmin.sh(exe) -user <username> -password <password>", this is a finding.
Fix Text
When starting WebSphere commands, such as wsadmin, stopManager, stopNode, stopServer, or syncNode; do not use the "-password <password>" option.
Use the interactive mode instead; you will be prompted for user id and password.
For scripts, you may configure user id and password in the "connector properties" files. These files are under "Profile_Root/Properties" folder.
- soap.client.props: for default SOAP
- sas.client.props : for RMI and JSR160RMI connectors
- ipc.client.props: for IPC connector
CCI Reference
CCI-000381- Created
- 2026-04-07 20:08:19
- Last Updated
- 2026-04-07 20:08:19