STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

The ColdFusion built-in Tomcat Web Server must use FIPS-validated ciphers on secured connectors.

DISA Rule

SV-279031r1171492_rule

Vulnerability Number

V-279031

Group Title

SRG-APP-000015-AS-000010

Rule Version

APAS-CF-000010

Severity

CAT II

CCI(s)

• CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.

Weight

10

Fix Recommendation

1. Enable FIPS Mode in Tomcat by editing the Tomcat server.xml configuration file.

2. From the Tomcat server, log in as a privileged user, open the server.xml file:
sudo nano $CATALINA_BASE/conf/server.xml

3. Locate or add the <Listener> element for AprLifecycleListener.

4. Ensure the element includes the FIPSMode="on" attribute.
Example configuration:
<Listener
className="org.apache.catalina.core.AprLifecycleListener"
SSLEngine="on"
FIPSMode="on"
/>

5. Save and close the file.

6. Restart ColdFusion to apply the changes.

7. Check coldfusion-error.log after startup to confirm there are no errors indicating failure to set FIPSMode.

Check Contents

Verify FIPS Mode in Configuration.

1. For each ColdFusion instance, locate the server.xml file in the following directory:
<ColdFusion Install Directory>\runtime\conf

2. Open server.xml.

3. Search for the <Listener> tag for AprLifecycleListener, confirm that it includes the attribute:
fipsmode="on"

If the fipsmode="on" attribute is not present, this is a finding.

4. Verify FIPS Mode at Runtime. After starting ColdFusion, open the coldfusion-error.log file.

5. Search for the term "fipsmode".

6. Check for the following message:
failed to set property[FIPSMODE] to [on]

If this error message is present in the log, this is a finding.

Vulnerability Number

V-279031

Documentable

False

Rule Version

APAS-CF-000010

Severity Override Guidance

Verify FIPS Mode in Configuration.

1. For each ColdFusion instance, locate the server.xml file in the following directory:
<ColdFusion Install Directory>\runtime\conf

2. Open server.xml.

3. Search for the <Listener> tag for AprLifecycleListener, confirm that it includes the attribute:
fipsmode="on"

If the fipsmode="on" attribute is not present, this is a finding.

4. Verify FIPS Mode at Runtime. After starting ColdFusion, open the coldfusion-error.log file.

5. Search for the term "fipsmode".

6. Check for the following message:
failed to set property[FIPSMODE] to [on]

If this error message is present in the log, this is a finding.

Check Content Reference

M

Target Key

5724