STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

The ColdFusion file ownership and permissions must be restricted to prevent unauthorized access to log tools.

DISA Rule

SV-279037r1171603_rule

Vulnerability Number

V-279037

Group Title

SRG-APP-000121-AS-000081

Rule Version

APAS-CF-000145

Severity

CAT III

CCI(s)

CCI-001493 - Protect audit tools from unauthorized access.
CCI-001494 - Protect audit tools from unauthorized modification.
CCI-001495 - Protect audit tools from unauthorized deletion.

Weight

Fix Recommendation

For ColdFusion running on Windows:
1. For each ColdFusion instance, navigate to:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf
<ColdFusion_Installation_Directory>\cfusion\runtime\lib

2. Right-click the directory and select "Properties".

3. Click the Security tab and then click "Advanced".

4. On the Permissions tab, click "Disable inheritance" and select "Remove all inherited permissions from this object".

5. Click "Add".

a. In the Permission Entry dialog, click "Select a principal".

b. Enter the user account running the ColdFusion service.

c. Grant Full Control and click "OK".

6. Click "Add" again.

a. In the Permission Entry dialog, click "Select a principal".

b. Enter the Administrators group.

c. Grant Full Control and click "OK".

7. Check "Replace all child object permission entries with inheritable permission entries from this object".

8. Click "OK" to apply the permissions.

For ColdFusion running on Linux:
Set ownership and permissions using the following commands, replacing the path and user as appropriate:
chown -R <cfuser>:root <ColdFusion_Installation_Directory>/cfusion/runtime/conf

chown -R <cfuser>:root <ColdFusion_Installation_Directory>/cfusion/runtime/lib

chmod -R 640 <ColdFusion_Installation_Directory>/cfusion/runtime/conf
chmod -R 640 <ColdFusion_Installation_Directory>/cfusion/runtime/lib

Check Contents

For ColdFusion running on Windows:
1. For each ColdFusion instance, navigate to:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf
<ColdFusion_Installation_Directory>\cfusion\runtime\lib

2. The logs directory and all files within it must have Full Control granted to the Administrators group and the user account running the ColdFusion service.

If any directory or file permissions do not meet this requirement, this is a finding.

For ColdFusion running on Linux:
1. Navigate to:
<ColdFusion_Installation_Directory>/cfusion/runtime/conf
<ColdFusion_Installation_Directory>/cfusion/runtime/lib

2. The logs tools directory and all files within it must have:
- "Owner" set to the user running ColdFusion.
- "Group ownership" set to root.
- "Permissions" set to 640 or more restrictive.

If ownership or permissions do not meet this requirement, this is a finding.

Vulnerability Number

V-279037

Documentable

False

Rule Version

APAS-CF-000145

Severity Override Guidance

For ColdFusion running on Windows:
1. For each ColdFusion instance, navigate to:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf
<ColdFusion_Installation_Directory>\cfusion\runtime\lib

2. The logs directory and all files within it must have Full Control granted to the Administrators group and the user account running the ColdFusion service.

If any directory or file permissions do not meet this requirement, this is a finding.

For ColdFusion running on Linux:
1. Navigate to:
<ColdFusion_Installation_Directory>/cfusion/runtime/conf
<ColdFusion_Installation_Directory>/cfusion/runtime/lib

2. The logs tools directory and all files within it must have:
- "Owner" set to the user running ColdFusion.
- "Group ownership" set to root.
- "Permissions" set to 640 or more restrictive.

If ownership or permissions do not meet this requirement, this is a finding.

Check Content Reference

Target Key

5724