STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

The ColdFusion log information must be protected from any type of unauthorized read access by having file ownership set properly.

DISA Rule

SV-279036r1171601_rule

Vulnerability Number

V-279036

Group Title

SRG-APP-000118-AS-000078

Rule Version

APAS-CF-000120

Severity

CAT II

CCI(s)

• CCI-000162 - Protect audit information from unauthorized access.
• CCI-000163 - Protect audit information from unauthorized modification.
• CCI-000164 - Protect audit information from unauthorized deletion.
• CCI-001314 - Reveal error messages only to organization-defined personnel or roles.

Weight

10

Fix Recommendation

Locate the logs directory for each ColdFusion instance. The log directory path is located in the ColdFusion Administrator Console under Debugging & Logging >> Logging Settings.

For ColdFusion running on Windows:
1. Right-click the logs directory and select "Properties".

2. Click the Security tab and then click "Advanced".

3. On the Permissions tab, click "Disable inheritance" and select "Remove all inherited permissions from this object".

4. Click "Add".
- In the Permission Entry dialog box, click "Select a principal".
- Enter the user account running the ColdFusion service.
- Grant Full Control and click "OK".

5. Click "Add" again.
- In the Permission Entry dialog, click "Select a principal".
- Enter the Administrators group.
- Grant full control and click "OK".

6. Check "Replace all child object permission entries with inheritable permission entries from this object".

7. Click "OK" to apply the permissions.

For ColdFusion running on Linux:
Set ownership and permissions using the following commands, replacing the path and user as appropriate:

chown -R <cfuser>:root /path/to/logs
chmod -R 740 /path/to/logs

Note: Required permissions are automatically set by the Auto-Lockdown Installer.

Check Contents

Verify that the log directories for each ColdFusion instance are secured with appropriate ownership and permissions.

1. Locate the logs directory for each ColdFusion instance. The log directory path is located in the ColdFusion Administrator Console under Debugging & Logging >> Logging Settings.

2. For ColdFusion running on Windows, the logs directory and all files within it must have Full Control granted to:
- The Administrators group.
- The user account running the ColdFusion service.

If any directory or file permissions do not meet this requirement, this is a finding.

3. For ColdFusion running on Linux, the logs directory and all files within it must have:
- "Owner" set to the user running ColdFusion.
- "Group ownership" set to root.
- "Permissions" set to 740 or more restrictive.

If ownership or permissions do not meet this requirement, this is a finding.

Vulnerability Number

V-279036

Documentable

False

Rule Version

APAS-CF-000120

Severity Override Guidance

Verify that the log directories for each ColdFusion instance are secured with appropriate ownership and permissions.

1. Locate the logs directory for each ColdFusion instance. The log directory path is located in the ColdFusion Administrator Console under Debugging & Logging >> Logging Settings.

2. For ColdFusion running on Windows, the logs directory and all files within it must have Full Control granted to:
- The Administrators group.
- The user account running the ColdFusion service.

If any directory or file permissions do not meet this requirement, this is a finding.

3. For ColdFusion running on Linux, the logs directory and all files within it must have:
- "Owner" set to the user running ColdFusion.
- "Group ownership" set to root.
- "Permissions" set to 740 or more restrictive.

If ownership or permissions do not meet this requirement, this is a finding.

Check Content Reference

M

Target Key

5724