---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security
Release :
- australia
ft:locale :
- de-DE
ft:publication_title :
- Australia Platform security
ft:clusterId :
- psec
bundleId :
- psec
workflow :
- Platform
---
# Baseline version 5.0
# Updated hardening settings for baseline version 5.0 {#ariaid-title1}
* Freigeben Version: Australia
*
* Aktualisiert 12. März 2026
*
*  14 Minuten Lesedauer
Some hardening settings have been updated with the release of Security Center baseline version 5.0.
Baseline version 5 includes several updates to short descriptions for style and consistency across records. In addition, many property related scripts were updated to improve the accuracy of default values in cases where the
property has been removed from the sys_property table.
{#updated-hardening-settings-for-baseline-version-five__table_g2z_bbt_bzb__entry__2}
| Documentation | Updates |
|-|-|
| [Require authorization for SOAP requests \[Updated in Security Center 1.3, 1.5, and 2.0\]](t_mcjJQajIo2aGOVbVFggw "Use the glide.basicauth.required.soap property to designate if incoming SOAP requests should require basic authorization.") | * New remediation: Ensure the Glide Property glide.basicauth.required.soap exists and is set to the value true. Alternatively, configure the instance for WS Security by setting the property glide.soap.require_ws_security to true and following the product documentation to configure WS Security Profiles. If the property does not appear in the sys_properties table, add a new record. * Old remediation: Ensure the property glide.basicauth.required.soap is set to the value true. Alternatively, configure the instance for WS Security by setting the property glide.soap.require_ws_security to true and following the product documentation to configure WS Security Profiles. {#updated-hardening-settings-for-baseline-version-five__ul_xgq_vw1_gdc} |
| [Enforce OCSP check on network error \[New in Security Center 1.3 and updated in 2.0\]](4eqb4Q2QE8fKWUQXHUYJlw "Learn how to configure the com.glide.communications.httpclient.ocsp_allow_network_error property to prevent bad actors from bypassing Online Certificate Status Protocol (OCSP) checks.") | * New remediation: Ensure the property com.glide.communications.httpclient.ocsp_allow_network_error exists and is set to false. If the property does not appear in the sys_properties table, add a new record. * Old Remediation: Ensure the property com.glide.communications.httpclient.ocsp_allow_network_error is set to false. {#updated-hardening-settings-for-baseline-version-five__ul_e1r_2x1_gdc} |
| [Disable external content url \[Updated in Security Center 2.0\]](yFZhx9aMjZPQ69OSqfyxfw "Manage how external link metadata is used in your instance with Connect Chat.") | * New remediation: Ensure the Glide Property glide.ui.url.external.content exists and is set to the value false. If the property does not appear in the sys_properties table, add a new record. * Old Remediation: Ensure the property glide.ui.url.external.content is set to false. * New CVSS Score: 7.2 * Old CVSS Score: 8.1 * Rule Script: Script has been updated to improve detection accuracy. {#updated-hardening-settings-for-baseline-version-five__ul_yyk_5x1_gdc} |
| [Restrict XML external entities \[Updated in Security Center 1.3 and 2.0\]](llsO9Yysck5_qCq9Xj63iw "Configure system properties to ensure that your instance only processes XML from trusted sources to help prevent XML external entity (XXE) attacks.") | * New remediation: Ensure the Glide Property glide.xml.entity.whitelist exists and is set to "" and the Glide Property glide.xml.entity.whitelist.enabled exists and is set to the value true. If the properties do not appear in the sys_properties table, add new records. * Old Remediation: Ensure the property glide.xml.entity.whitelist is set to "" and the property glide.xml.entity.whitelist.enabled is set to true. {#updated-hardening-settings-for-baseline-version-five__ul_hhl_2z1_gdc} |
| [Disable unauthenticated published reports \[Updated in Security Center 2.0\]](q_ZPjxcHiUyEboTjsrW~2w "Deactivate this property to prevent the user from publishing or accessing reports. This property disables the published reports feature in reporting.") | * New remediation: Ensure the Glide Property glide.report.published_reports.enabled exists and is set to the value false. If the property does not appear in the sys_properties table, add a new record. * Old Remediation: Ensure the property glide.report.published_reports.enabled is set to false. {#updated-hardening-settings-for-baseline-version-five__ul_t4d_scb_gdc} |
| [Enable password reset policy checks \[Updated in Security Center 2.0\]](Sur6V8BsdWICd~5ENqoF~Q "Use the glide.enable.password_policy property to enable password policy checks whenever a user changes their password using the user interface.") | * New remediation: Ensure the Glide Property glide.enable.password_policy exists and is set to the value true. If the property does not appear in the sys_properties table, add a new record. * Old Remediation: Ensure the property glide.enable.password_policy is set to true. {#updated-hardening-settings-for-baseline-version-five__ul_ccg_bdb_gdc} |
| [Minimize Entity Expansion Threshold for GlideXMLUtil Scriptable \[Updated in Security Center 1.3, 1.5, and 2.0\]](a~RBw~FLC1vDlCJ_yHJ7og "Use the glide.xmlutil.max_entity_expansion property to change the maximum entity expansion limit to a smaller number.") | * New remediation: Ensure the property glide.xmlutil.max_entity_expansion is set to 3000 or less. If the instance is on Washington or later, the default implied value is 3000 if the sys_properties record does not exist. If the instance is not on Washington or later, the recommendaiton is for the instance admin to create a sys_properties record with name glide.xmlutil.max_entity_expansion and the value 3000. * Old Remediation: Ensure the property glide.xmlutil.max_entity_expansion is set to 3000 or less. {#updated-hardening-settings-for-baseline-version-five__ul_u3j_lfb_gdc} |
| [Disable outbound SSLv2/SSLv3 connections \[Updated in Security Center 1.3\]](_rn5yvFk_YGCD1WRLqXG9g "Use the glide.outbound.sslv3.disabled property to force the MID Server to use TLS when making outbound connections, such as REST and SOAP requests. Normally, outbound connections from an instance are forced to use TLS instead of SSL.") | * New remediation: Ensure the Glide Property glide.outbound.sslv3.disabled exists and is set to the value true. If the property does not appear in the sys_properties table, add a new record. * Old Remediation: Ensure the property glide.outbound.sslv3.disabled is set to true. {#updated-hardening-settings-for-baseline-version-five__ul_t2q_sfb_gdc} Wichtig: The value for the glide.outbound.sslv3.disabled property is a safe override and cannot be altered once changed. |
| [Disable GlideRecord Scope Fencing Legacy Behavior \[New in Security Center 1.3 and updated in 1.5 and 2.0\]](Q4AiOEk_siPtibdffTRNdA "The glide.record.legacy_cross_scope_access_policy_in_script property disables scope fencing allowing scoped apps to access global script interfaces. It was created as a patch to GlideRecord's cross scope access.") | * New short description: Disable GlideRecord Scope Fencing Legacy Behavior * Old short description: Enable GlideRecord Scope Fencing Legacy Behavior {#updated-hardening-settings-for-baseline-version-five__ul_jln_zfb_gdc} |
| [Restrict uploaded MIME types \[Updated in Security Center 1.3 and 2.0\]](E0LVZJQo1D39SdL4amow~w "Use the glide.security.file.mime_type.validation property to activate MIME type checking for uploads. You can enable (set the property to true) or disable (set it to false) MIME type validation for file attachments.") | * New remediation: Ensure the property glide.security.file.mime_type.validation exists and is set to true. If the property does not appear in the sys_properties table, add a new record. * Old remediation: Ensure the property glide.security.file.mime_type.validation is set to true. {#updated-hardening-settings-for-baseline-version-five__ul_nfw_2gb_gdc} |
| [Enable Jelly JS interpolation protection for nested expressions \[Updated in Security Center 2.0\]](P2KlbUj8HUGUa2B_uMf2Pg "Manage the interpolation protection on your instance.") | * New remediation: Ensure the Glide Property glide.ui.jelly.js_interpolation.protect_nested_expressions exists and is set to the value true. If the property does not appear in the sys_properties table, add a new record. * Old remediation: Ensure the property glide.ui.jelly.js_interpolation.protect_nested_expressions is set to true. {#updated-hardening-settings-for-baseline-version-five__ul_wjx_jgb_gdc} |
| [Enable SSL in LDAP authentication \[Updated in Security Center 1.5 and 2.0\]](Sb2nQyCTHgZnP4njGU51Pw "Manage the encryption of LDAP authentication requests on your instance.") | Rule Script: Script has been updated to improve detection accuracy. |
| [Enable UserCookie version 3.1 \[Updated in Security Center 2.0\]](5y7WMwx4RLiMGDoAEHK9wg "Manage the version of UserCookie that is enabled on your instance to secure the storage of the secret key in the source code.") | * New description: UserCookie v3 is generated only when property glide.ui.secure.cookies.use_kmf is disabled. UserCookie v3 is not secure due to storing secret key for HMAC in source code and identical for all customers. That can support malicious actors to use this one secret key for attempts to hijacking user sessions. By setting the property glide.ui.secure.cookies.use_kmf to true UserCookie v3.1 will be used and secret key will be stored in security storage such as KMF. * Old description: UserCookie v3 is generated only when property glide.ui.secure.cookies.use_kmf is disabled. UserCookie v3 is not secure due to storing secret key for HMAC in source code and identical for all customers. That can support malicious actors to use this one secret key for attempts to hijacking user sessions. * New remediation: Ensure the property glide.ui.secure.cookies.use_kmf exists and is set to true. If the property does not appear in the sys_properties table, add a new record. * Old remediation: Ensure the property glide.ui.secure.cookies.use_kmf is set to true. Which means UserCookie v3.1 will be used and secret key will be stored in security storage such as KMF. {#updated-hardening-settings-for-baseline-version-five__ul_xzc_rgb_gdc} |
| [Set OTP lifetime for password reset to 1 hour \[Updated in Security Center 2.0\]](q12TgYV26IHgbhgkMTODcw "Control the time duration of the link in the password reset email.") | Rule Script: Script has been updated to improve detection accuracy. |
| [Log user impersonation \[Updated in Security Center 1.3 and 2.0\]](lCeRaepopsnQLoxPkDWTOw "Configure glide.sys.log_impersonation to control if user-impersonating events are logged in your instance.") | * New remediation: Ensure the property glide.sys.log_impersonation exists and is set to true. If the property does not appear in the sys_properties table, add a new record. * Old remediation: Ensure the property glide.sys.log_impersonation is set to true. {#updated-hardening-settings-for-baseline-version-five__ul_x4f_rhb_gdc} |
| [Required jms connection factories \[New in Security Center 1.3 and updated in 1.5 and 2.0\]](DSQ4jCIC83waKxC~k773NQ "The mid.property.jms.command.allowed_factory_names property controls the Java Messaging Service (JMS) connection factories that the MID Server can use.") | Rule Script: Script has been updated to improve detection accuracy. |
| [Ensure dashboards creation/deletion requires access check \[New in Security Center 1.3 and updated in 2.0\]](s11_aD28ivonSR~NlalwHw "The glide.processors.check_access_before_process system property enables access control list (ACL) enforcement for creating or deleting dashboards when a user is logged in.") | * New remediation: Ensure the Glide Property glide.processors.check_access_before_process exists and is set to the value true. If the property does not appear in the sys_properties table, add a new record. * Old remediation: Ensure the value of glide.processors.check_access_before_process is always true. {#updated-hardening-settings-for-baseline-version-five__ul_oxs_yhb_gdc} |
| [Proactively Invalidate Sessions After Defined Durations](https://servicenow-prod.fluidtopics.net/yjdAFqeeT1NA7yvITLA8Lg "The glide.active.session.timeout.invalidate.session property controls whether a timeout session is proactively invalidated before the Tomcat server.") | * New remediation: Ensure the Glide Property glide.active.session.timeout.invalidate.session exists and is set to the value true. If the property does not appear in the sys_properties table, add a new record. * Old remediation: Set the Glide Property glide.active.session.timeout.invalidate.session to true. {#updated-hardening-settings-for-baseline-version-five__ul_rfd_33b_gdc} |
| [Enforce Security Scope for Agent Workspace for HR Case Management \[New in Security Center 1.5 and updated in 2.0\]](2W38CCzVRn8P~qKu_nfVHw "Configure the Agent Workspace for HR Case Management plugin so that data in scope master tables can only be accessed by users with the correct permissions, enforcing the principle of least privilege.") | Rule Script: Script has been updated to improve detection accuracy. |
| [Enforce security scope license and permit playbook \[New in Security Center 1.5 and updated in 2.0\]](bLQVEdxrBCLn5Mn~49WV1A "Use this property to determine if only the access control lists (ACLs) within the License and Permit plugin will be used in determining access to the scope, or if ACLs from all scopes will be considered.") | Rule Script: Script has been updated to improve detection accuracy. |
| [Restrict downloadable MIME types \[Updated in Security Center 1.3 and 2.0\]](2yJUSewNxbHR11KmPlBE7Q "The glide.ui.attachment.download_mime_types property will force the specified list of dangerous file types to be downloaded to the client and not viewed inline in the browser.") | * New description: If the property glide.ui.attachment.force_download_all_mime_types is set to true, then the glide.ui.attachment.download_mime_types property will be overridden so that all MIME types will be downloaded rather than rendered by the browser. For example, downloading text/html forces an HTML file to be downloaded to the client as a file rather than viewed inline in the browser, preventing a XSS attack. XSS can lead to easily attained privilege escalation to higher roles such as admin where more lateral movement can be taken. * Old description: If the property glide.ui.attachment.force_download_all_mime_types is not set to true, then the glide.ui.attachment.download_mime_types property will be overridden so that all MIME types will be downloaded rather than rendered by the browser. For example, downloading text/html forces an HTML file to be downloaded to the client as a file rather than viewed inline in the browser, preventing a XSS attack. The ability to have XSS can lead to easily attained privilege escalation to higher roles such as admin where more lateral movement can be taken. * New remediation: Ensure the property glide.ui.attachment.force_download_all_mime_types is set to true. If the property does not exist in the sys_properties table, the default value is false. * Old remediation: Ensure the property glide.ui.attachment.force_download_all_mime_types is set to true. * Rule Script: Script has been updated to improve detection accuracy. {#updated-hardening-settings-for-baseline-version-five__ul_ubw_tqz_fdc} |
| [Define restricted downloadable MIME types \[Updated in Security Center 1.3, 1.5, and 2.0\]](_5HlZr2WInPvjFQlv8RGqQ "Use the glide.ui.attachment.force_download_all_mime_types property to download MIME types and not to render inline in the browser.") | Rule Script: Script has been updated to improve detection accuracy. |
| [Disallow infected file download \[Updated in Security Center 1.5 and 2.0\]](~hlV0c747Ux4x7yTFawKWw "Control whether users can download non-scanned attachments if the antivirus service is down or unreachable.") | * New description: When the property com.glide.snap.infected_download_allowed is set to true, users can still download non-scanned attachments in the case that the antivirus service is down or unreachable. This means it is possible that a user downloads a malicious file and risks infecting the user's desktop (in the case there is no other endpoint protection on the device). * Old description: If com.glide.snap.infected_download_allowed is not set to the recommended value of False, then it is possible to download a malicious file that has not been scanned leading to a risk of infecting the user's desktop. * New remediation: Ensure the property com.glide.snap.infected_download_allowed is set to false. * Old remediation: Ensure the property com.glide.snap.infected_download_allowed is set to False. {#updated-hardening-settings-for-baseline-version-five__ul_sw3_v5z_fdc} |
| [Restrict access to GlideSystemUserSession scriptable API \[Updated in Security Center 1.3 and 2.0\]](1s~apUT3v_ieMbF2riQauA "The client callable GlideSystemUserSessionSandbox scriptable API exposes GlideSystemUserSession's addErrorMessageNoSanitization and addInfoMessageNoSanitization methods to the JavaScript sandbox. This allows all users to call this method via script.") | * New description: gs.addErrorMessageNoSanitizationMessaging() and gs.addInfoMessageNoSanitization() are used within the scripting environment for logging and notifications. Both of these are available in the sandbox if this property is not set to the recommended value of false. The sandbox is a low privileged scripting environment available to unauthenticated and no role users. Both of these methods can be used to display unsanitized input to a user. Displaying unsanitized input to the user is dangerous, as unsanitized input may contain dangerous code that runs in the user's browser. This can be utilized for traditional reflected XSS attacks. Reflected XSS attacks can be used in multiple scenarios, including session hijacking. * Old description: Messaging within the glide scripting sandbox is used for logging purposes. Calling this unsanitized error function exposes the platform to reflected XSS attacks. XSS attacks can allow for easy privilege escalation by stealing someone's session cookies. If glide.sandbox.usersession.allow_unsanitized_messages is not set to the recommended value of false, then the unsanitized error messaging functions addErrorMessageNoSanitization and addInfoMessageNoSanitization are available to script. {#updated-hardening-settings-for-baseline-version-five__ul_bwc_gwz_fdc} |
| [Enable work order management query rules for service organizations \[New in Security Center 1.5 and updated in 2.0\]](~hl5y2gk_GYFYPHWcd4Fbw "Use the sn_fsm.use_query_rules property to apply rules and filters to the Field Service Management tables.") | * New description: When set to true, rules/filters from sn_query_rule table will be used to determine read access to Field Service Management-related tables (Work Order and Work Order Task) to the logged in user through query business rules and read ACLs. When false, the records won't be filtered based on query rules. Query business rules add additional security validations. Specifically, this property will filter records for agents, qualifiers, and dispatchers based on their assigned territory or territory membership. It is best practice to follow the principle of least privilege when reading records. When this property is not set to true, there may be increased risk of data exposure from Field Service Management tables. * Old description: When set to true, rules/filters from sn_query_rule table will be used to determine read access to Field Service Management-related tables (Work Order and Work Order Task) to the logged in user through query business rules and read ACLs. When false, the records won't be filtered based on query rules. Query business rules add additional security validations. Specifically, this property will filter records for agents, qualifiers, and dispatchers based on their assigned territory or territory membership. It is best practice to follow the principle of least privilege when reading records. {#updated-hardening-settings-for-baseline-version-five__ul_jff_gxz_fdc} |
| [Restrict email domains for external user registration \[Updated in Security Center 1.3, 1.5, and 2.0\]](D7fZ1zXzm3avTSpuQmcoUg "Use the sn_ext_usr_reg.allowed_email_domains property to list acceptable external email domains.") | * New description: The sn_ext_usr_reg.allowed_email_domains property defines which email addresses are allowed to self-register to a ServiceNow instance. The format should be a comma separated list of acceptable email domains such as domain1.com,domain2.com where emails such as example@domain2.com will be accepted. If sn_ext_usr_reg.allowed_email_domains is not set with a list of acceptable domains, then users with any email address are allowed to register accounts on the instances. If not defined, malicious actors could perform registration using emails addresses from unwanted domains to gain authenticated access to the instance. * Old description: The sn_ext_usr_reg.allowed_email_domains property defines which email addresses are allowed to self-register to a ServiceNow instance. If sn_ext_usr_reg.allowed_email_domains is not set with a list of acceptable domains, then users with any email address are allowed to register accounts on the instances. If not defined, malicious actors could perform registration using emails addresses from unwanted domains to gain authenticated access to the instance. {#updated-hardening-settings-for-baseline-version-five__ul_nkc_1yz_fdc} |
| [Apply domain separation on dot walked fields \[Updated in Security Center 1.3, 1.5, and 2.0\]](qkKEMZJ1WRVi4hsMVuAPHg "The glide.sys.domain.include_domain_condition_on_join property controls whether join queries are given domain separated conditions or not in order to ensure they apply domain separation functionality for dot walked fields.") | * New description: This property controls whether join queries are given domain separated conditions or not, in order to ensure they apply domain separation functionality for dot walked fields. If glide.sys.domain.include_domain_condition_on_join is not set to the recommended value of true on an instance using domain separation, then sensitive information could be disclosed that is not to be shared with a specific domain. There may be moderate functional impact to the instance if components are reliant on the unsafe cross domain queries. Instances should be tested in subproduction environments before enabling. * Old description: This property controls whether join queries are given domain separated conditions or not, in order to ensure they apply domain separation functionality for dot walked fields. If glide.sys.domain.include_domain_condition_on_join is not set to the recommended value of true on an instance using domain separation, then sensitive information could be disclosed that is not to be shared with a specific domain. {#updated-hardening-settings-for-baseline-version-five__ul_lbs_czz_fdc} |
| [Enforce URL allowlist check \[Updated in Security Center 1.3, 1.5, and 2.0\]](zM6EXddsgSbTkCa2DIbroQ "Use the glide.security.url.whitelist system property to add extra layer of validation to ensure whether any external URL introduced should be a part of inclusion listed URLs.") | * New remediation: Ensure the property glide.security.url.whitelist.strict_check is set to true or the property glide.security.url.whitelist is set to a value. * Old remediation: Ensure the property glide.security.url.whitelist.strict_check is set to "true" and the property glide.security.url.whitelist is set to a value. {#updated-hardening-settings-for-baseline-version-five__ul_pqm_xzz_fdc} |
| [Set guest user for soap requests \[Updated in Security Center 1.3 and 2.0\]](BgBQJ_Qn13nzoqMl2OX5BQ "Configure this property to control the level of access of unauthenticated SOAP requests.") | Rule Script: Script has been updated to improve detection accuracy. |
| [Restrict access to background script \[Updated in Security Center 1.3 and 2.0\]](Pm8NaEHLtidxGcw~Ev228w "Use a system property to set a role requirement for accessing the Script Background module.") | * New description: This property holds the required role to access Script Background module. If glide.script_processor.admin is not set to the recommended and default value of admin, then users having a lower privileged role will be able to run background scripts on the instance. This will lead to a complete bypass of the ACL system allowing full access to tables. * Old description: This property holds the required role to access Script Background module. If glide.script_processor.admin is not set to the recommended value of admin, security_admin, or maint, then users having a lower privileged role will be able to run background scripts on the instance. This will lead to a complete bypass of the ACL system allowing full access to tables. * New remediation: Ensure the property glide.script_processor.admin is set to the admin. This is the default value on instances. * Old remediation: Ensure the property glide.script_processor.admin is set to the admin, security_admin, or maint role. {#updated-hardening-settings-for-baseline-version-five__ul_pmp_rb1_gdc} |
| [Verify certificate chain and hostname \[New in Security Center 1.3 and updated in 2.0\]](upaAbS__UHyQ~ZFJBin8Mw "Configure the com.glide.communications.httpclient.verify_hostname property to prevent man-in-the-middle-attacks by ensuring that the certification verification process is executed.") | * New description: When the Glide Property com.glide.communications.httpclient.verify_hostname is not set to the secure value of true, the hostname and certificate chain presented by remote hosts during a TLS connection initiated from the ServiceNow instance are not validated. This could compromise the security of the TLS connection and allow person-in-the-middle attacks, where communications between two parties are intercepted. This may lead to sensitive data disclosure. * Old description: If com.glide.communications.httpclient.verify_hostname is not set to true this could allow person-in-the-middle attacks where communications between two parties are intercepted. Setting this property to an insecure value disables the certificate verification process which evaluates all certifications in the certificate chain through checking revocation status. Set this property to true to prevent the http client from connecting to a potentially harmful hostname. {#updated-hardening-settings-for-baseline-version-five__ul_ikp_pc1_gdc} |
| [Control Lockout Time for Invalid Password Reset Attempts \[Updated in Security Center 1.3 and 2.0\]](DJxvJLi4Q6okjqZ_l2R5vg "The password_reset.request.max_attempt_window property controls the number of minutes a user must wait to reset or change their password after exceeding the maximum number of unsuccessful attempts that is set with the password_reset.request.max_attempt property.") | * New short description: Control Lockout Time for Invalid Password Reset Attempts * Old short description: Minimize Reset Password Request Max Attempts Window Duration * New description: The password_reset.request.max_attempt_window property defines the number of minutes a user must wait to reset or change their password after exceeding the maximum number of unsuccessful attempts that is set with the password_reset.request.max_attempt property. A small number of minutes for the password_reset.request.max_attempt_window property increases the risk of successfully brute forcing a password as a greater number of password reset attempts can be made. The default of 1440 minutes is recommended. * Old description: If password_reset.request.max_attempt_window is not set to the recommended value of 1440 or less, then it could be possible to perform account bruteforce as the account will not be locked after a maximum number of wrong authentication attempts. * New remediation: Ensure the property password_reset.request.max_attempt_window is set to 1440 or greater. * Old remediation: Ensure the property password_reset.request.max_attempt_window is set to 1440 or less. * Rule Script: Script has been updated to improve detection accuracy. {#updated-hardening-settings-for-baseline-version-five__ul_f5d_t5g_czb} |
| [Disable GlideRecord Scope Fencing Legacy Behavior \[New in Security Center 1.3 and updated in 1.5 and 2.0\]](Q4AiOEk_siPtibdffTRNdA "The glide.record.legacy_cross_scope_access_policy_in_script property disables scope fencing allowing scoped apps to access global script interfaces. It was created as a patch to GlideRecord's cross scope access.") | * New short description: Disable GlideRecord Scope Fencing Legacy Behavior * Old short description: Enable GlideRecord Scope Fencing Legacy Behavior * New remediation: Set the Glide Property glide.record.legacy_cross_scope_access_policy_in_script to false. When not present in the sys_properties table, the default value is true. * Old remediation: Set the Glide Property glide.record.legacy_cross_scope_access_policy_in_script to false. {#updated-hardening-settings-for-baseline-version-five__ul_t5d_t5g_czb} |
| [Limit Invalid Password Reset Attempts \[Updated in Security Center 1.3 and updated in 2.0\]](eKCSSSyCPrpDmeeI3FA2aA "The password_reset.request.max_attempt is used to control the maximum number of unsuccessful attempts that a user can reset or change their password before being locked out for a specified period of time.") | * New short description: Limit Invalid Password Reset Attempts * Old short description: Minimize Reset Password Request Max Attempt Allowance {#updated-hardening-settings-for-baseline-version-five__ul_a1w_gjg_gdc} |
[ ]
{#updated-hardening-settings-for-baseline-version-five__table_g2z_bbt_bzb}