STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

ColdFusion must have only approved Tomcat connectors enabled.

DISA Rule

SV-279047r1171513_rule

Vulnerability Number

V-279047

Group Title

SRG-APP-000141-AS-000095

Rule Version

APAS-CF-000250

Severity

CAT III

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

1. Obtain information system security officer (ISSO) approvals for the configured connectors and document in the SSP.

2. Locate the server.xml file. For each ColdFusion instance, navigate to:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf\server.xml

3. Create a backup of this file.

4. Edit the file and remove any unapproved connectors by deleting the "Connector" tag or using XML syntax to comment out the configuration. XML comment syntax starts with <!-- and ends with -->

Check Contents

Review SSP for list of approved connectors and associated TCP/IP ports. Verify only approved connectors are present.

1. Locate the server.xml file. For each ColdFusion instance, navigate to:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf\server.xml

2. Open the server.xml file in a text editor. Locate the "Connector" tags that are not commented out.

3. Verify all connectors and their associated network ports are approved in the system security plan (SSP).

If connectors are found but are not approved in the SSP, this is a finding.

Vulnerability Number

V-279047

Documentable

False

Rule Version

APAS-CF-000250

Severity Override Guidance

Review SSP for list of approved connectors and associated TCP/IP ports. Verify only approved connectors are present.

1. Locate the server.xml file. For each ColdFusion instance, navigate to:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf\server.xml

2. Open the server.xml file in a text editor. Locate the "Connector" tags that are not commented out.

3. Verify all connectors and their associated network ports are approved in the system security plan (SSP).

If connectors are found but are not approved in the SSP, this is a finding.

Check Content Reference

M

Target Key

5724