STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

ColdFusion must have Tomcat configured with deployXML disabled.

DISA Rule

SV-279048r1171516_rule

Vulnerability Number

V-279048

Group Title

SRG-APP-000141-AS-000095

Rule Version

APAS-CF-000255

Severity

CAT III

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

Disable deployXML in server.xml.

1. Locate the server.xml file. For each ColdFusion instance, navigate to:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf\server.xml

2. Before making any changes, create a backup copy of the file.

Windows Example:
copy server.xml server.xml.bak

Linux Example:
cp server.xml server.xml.bak

3. Edit the configuration by opening server.xml in a text editor with administrative privileges.

4. Locate all <Host> elements with:
deployXML="true"

5. Change all attributes to:
deployXML="false"

6. Restart ColdFusion to apply the configuration changes.

7. Confirm that ColdFusion services started successfully.

8. Reopen server.xml to confirm that deployXML="false" is set for all <Host> elements.

Check Contents

DeployXML Configuration in server.xml.

1. Locate the server.xml file. For each ColdFusion instance, navigate to:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf\server.xml

2. Review the server.xml configuration by opening the server.xml file in a text editor.

3. Search for all <Host> elements.

4. Check the deployXML attribute. Inspect each <Host> element for the deployXML setting.

If any <Host> element has "deployXML="true"", this is a finding.

Vulnerability Number

V-279048

Documentable

False

Rule Version

APAS-CF-000255

Severity Override Guidance

DeployXML Configuration in server.xml.

1. Locate the server.xml file. For each ColdFusion instance, navigate to:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf\server.xml

2. Review the server.xml configuration by opening the server.xml file in a text editor.

3. Search for all <Host> elements.

4. Check the deployXML attribute. Inspect each <Host> element for the deployXML setting.

If any <Host> element has "deployXML="true"", this is a finding.

Check Content Reference

M

Target Key

5724