STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

ColdFusion must not have local users.

DISA Rule

SV-279033r1171269_rule

Vulnerability Number

V-279033

Group Title

SRG-APP-000080-AS-000045

Rule Version

APAS-CF-000040

Severity

CAT III

CCI(s)

• CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.

Weight

10

Fix Recommendation

Configure External User Accounts:

1. From the Admin Console Landing Screen, navigate to Security >> User Manager.

2. For any user accounts where "External User" is not checked and "User Type" is not selected:

a. Edit the user account (or remove the account if it should not exist).

b. Check the box for "External User".

c. Select the appropriate "User Type".

d. Click "Update User" to save the changes.

e. Verify that no local user accounts remain and that all users are correctly configured as external.

Check Contents

Verify there are no local users.

1. From the Admin Console Landing Screen, navigate to Security >> User Manager.

2. For each user, validate "External User" is checked and "User Type" is selected.

If "External User" is not checked and "User Type" is not selected, this is a finding.

Vulnerability Number

V-279033

Documentable

False

Rule Version

APAS-CF-000040

Severity Override Guidance

Verify there are no local users.

1. From the Admin Console Landing Screen, navigate to Security >> User Manager.

2. For each user, validate "External User" is checked and "User Type" is selected.

If "External User" is not checked and "User Type" is not selected, this is a finding.

Check Content Reference

M

Target Key

5724