STIGhubSTIGhub
STIGsSearchCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 3 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to Application Server Security Requirements Guide

V-204822

CAT II (Medium)

The application server must remove organization-defined software components after updated versions have been installed.

Rule ID

SV-204822r961677_rule

STIG

Application Server Security Requirements Guide

Version

V4R4

CCIs

CCI-002617

Discussion

Installation of patches and updates is performed when there are errors or security vulnerabilities in the current release of the software. When previous versions of software components are not removed from the application server after updates have been installed, an attacker may use the older components to exploit the system.

Check Content

Review the application server documentation and configuration to determine if organization-defined software components are removed after updated versions have been installed.

If organization-defined software components are not removed after updated versions have been installed, this is a finding.

Fix Text

Configure the application server to remove organization-defined software components after updated versions have been installed.