STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

ColdFusion must be configured with autoDeploy disabled.

DISA Rule

SV-279049r1171519_rule

Vulnerability Number

V-279049

Group Title

SRG-APP-000141-AS-000095

Rule Version

APAS-CF-000260

Severity

CAT III

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

Disable autoDeploy in server.xml.

1. Locate the server.xml file. For each ColdFusion instance, navigate to:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf\server.xml

2. Before making any changes, create a backup copy of the file.

Windows Example:
copy server.xml server.xml.bak

Linux Example:
cp server.xml server.xml.bak

3. Edit the configuration by opening server.xml in a text editor with administrative privileges.

4. Locate all <Host> elements with:
autoDeploy="true"

5. Change all attributes to:
autoDeploy="false"

6. Restart ColdFusion to apply the configuration changes.

7. Confirm that ColdFusion services started successfully.

8. Reopen server.xml to confirm that autoDeploy="false" is set for all <Host> elements.

Check Contents

Review the autoDeploy configuration in server.xml.

1. Locate the server.xml file. For each ColdFusion instance, navigate to:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf\server.xml

2. Review the server.xml configuration by opening the server.xml file in a text editor.

3. Search for all <Host> elements.

4. Check the autoDeploy Attribute. Inspect each <Host> element for the autoDeploy setting.

If any <Host> element has "autoDeploy="true"", this is a finding.

Vulnerability Number

V-279049

Documentable

False

Rule Version

APAS-CF-000260

Severity Override Guidance

Review the autoDeploy configuration in server.xml.

1. Locate the server.xml file. For each ColdFusion instance, navigate to:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf\server.xml

2. Review the server.xml configuration by opening the server.xml file in a text editor.

3. Search for all <Host> elements.

4. Check the autoDeploy Attribute. Inspect each <Host> element for the autoDeploy setting.

If any <Host> element has "autoDeploy="true"", this is a finding.

Check Content Reference

M

Target Key

5724