STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

ColdFusion must produce log records containing information to establish what type of events occurred.

DISA Rule

SV-279034r1171436_rule

Vulnerability Number

V-279034

Group Title

SRG-APP-000095-AS-000056

Rule Version

APAS-CF-000070

Severity

CAT III

CCI(s)

• CCI-000130 - Ensure that audit records containing information that establishes what type of event occurred.
• CCI-000131 - Ensure that audit records containing information that establishes when the event occurred.
• CCI-000132 - Ensure that audit records containing information that establishes where the event occurred.
• CCI-000133 - Ensure that audit records containing information that establishes the source of the event.
• CCI-000134 - Ensure that audit records containing information that establishes the outcome of the event.
• CCI-001487 - Ensure that audit records containing information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.
• CCI-000135 - Generate audit records containing the organization-defined additional information that is to be included in the audit records.

Weight

10

Fix Recommendation

1. Locate the neo-logging.xml file for ColdFusion: <ColdFusion_Installation_Directory>\lib\neo-logging.xml

2. After creating a backup of this file, edit it and locate the <var name='pattern'/> element.

3. Set the value of this element to include all pertinent fields, for example:
<string>"%p","%t",%d{"MM/dd/yy","HH:mm:ss"},"%a","%m%z"%n</string>

Check Contents

Verify neo-logging.xml Log Pattern configuration.

1. Open the neo-logging.xml file located at:
<ColdFusion_Installation_Directory>\lib\neo-logging.xml

2. Examine the <var name='pattern'/> element. Review the value assigned to this element. Verify the log pattern configuration.

3. Confirm the value is:
<string>"%p","%t",%d{"MM/dd/yy","HH:mm:ss"},"%a","%m%z"%n</string>

OR

Ensure the following pattern definition is included:
- The pattern includes the %d (date/time) pattern definition with the appropriate format (MM/dd/yy and HH:mm:ss).
- The pattern includes the %m (message) pattern.

If the neo-logging.xml file is missing or cannot be located, this is a finding.

If the <var name='pattern'/> element does not contain the exact required pattern, this is a finding.

If the pattern does not include the %d token with the required date/time format, this is a finding.

If the pattern does not include the %m (message) token, this is a finding.

Vulnerability Number

V-279034

Documentable

False

Rule Version

APAS-CF-000070

Severity Override Guidance

Verify neo-logging.xml Log Pattern configuration.

1. Open the neo-logging.xml file located at:
<ColdFusion_Installation_Directory>\lib\neo-logging.xml

2. Examine the <var name='pattern'/> element. Review the value assigned to this element. Verify the log pattern configuration.

3. Confirm the value is:
<string>"%p","%t",%d{"MM/dd/yy","HH:mm:ss"},"%a","%m%z"%n</string>

OR

Ensure the following pattern definition is included:
- The pattern includes the %d (date/time) pattern definition with the appropriate format (MM/dd/yy and HH:mm:ss).
- The pattern includes the %m (message) pattern.

If the neo-logging.xml file is missing or cannot be located, this is a finding.

If the <var name='pattern'/> element does not contain the exact required pattern, this is a finding.

If the pattern does not include the %d token with the required date/time format, this is a finding.

If the pattern does not include the %m (message) token, this is a finding.

Check Content Reference

M

Target Key

5724