STIGQter STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

ColdFusion must restrict unauthorized remote access to the ColdFusion Administrator Console and ensure all ports used are approved and properly secured.

DISA Rule

SV-279054r1171443_rule

Vulnerability Number

V-279054

Group Title

SRG-APP-000142-AS-000014

Rule Version

APAS-CF-000300

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Restrict unauthorized remote access to the ColdFusion Administrator Console and ensure all ports used, including WebSocket configurations, are approved and properly secured.

If the ColdFusion server is to be administered locally only:

1. Locate the server.xml file for ColdFusion.

Linux:
<ColdFusion Install Directory>/runtime/conf/server.xml

Windows:
<ColdFusion Install Directory>\runtime\conf\server.xml

2. Create a backup copy of server.xml before making changes.

3. Edit the file and update all <Connector> tags for HTTP and HTTPS to include:
address="127.0.0.1"
(This restricts access to the local server only.)

4. Restart ColdFusion to apply the changes.

5. Verify that the ColdFusion Administrator Console is accessible only from the local server and not from any external IP addresses.

6. If local access is confirmed, remove the backup file to avoid configuration confusion.

7. For any "Data & Services" configurations using unapproved ports:

a. Reconfigure all affected services or data connections to use approved ports in accordance with organizational policy.

b. Save changes and restart services.

Check Contents

Verify that remote access to the ColdFusion Administrator Console is appropriately restricted and that all configured ports, including WebSocket configurations, comply with approved organizational policies.

1. Validate Access Scope to the Administrator Console.

2. Identify whether the ColdFusion Administrator Console is accessible via any IP address other than localhost.

3. If remote (nonlocalhost) access is possible, confirm whether the server is designated for remote administration.

If remote access is enabled on a server intended for local administration only, this is a finding.

4. Confirm Administrator Console Port Compliance. Access the ColdFusion Administrator Console in a web browser.

If the URL specifies a port number, verify the port is approved per organizational policy.

If an unapproved port is used, this is a finding.

5. Review Data & Services Connection Ports. From the Admin Console Landing Screen, navigate to Data & Services.

6. For each tab, review port configurations for all connections and services.

If any service is configured to use a nonapproved port, this is a finding.

Vulnerability Number

V-279054

Documentable

False

Rule Version

APAS-CF-000300

Severity Override Guidance

Verify that remote access to the ColdFusion Administrator Console is appropriately restricted and that all configured ports, including WebSocket configurations, comply with approved organizational policies.

1. Validate Access Scope to the Administrator Console.

2. Identify whether the ColdFusion Administrator Console is accessible via any IP address other than localhost.

3. If remote (nonlocalhost) access is possible, confirm whether the server is designated for remote administration.

If remote access is enabled on a server intended for local administration only, this is a finding.

4. Confirm Administrator Console Port Compliance. Access the ColdFusion Administrator Console in a web browser.

If the URL specifies a port number, verify the port is approved per organizational policy.

If an unapproved port is used, this is a finding.

5. Review Data & Services Connection Ports. From the Admin Console Landing Screen, navigate to Data & Services.

6. For each tab, review port configurations for all connections and services.

If any service is configured to use a nonapproved port, this is a finding.

Check Content Reference

M

Target Key

5724