STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

ColdFusion must transmit only encrypted representations of passwords to the mail server.

DISA Rule

SV-279060r1207648_rule

Vulnerability Number

V-279060

Group Title

SRG-APP-000172-AS-000120

Rule Version

APAS-CF-000355

Severity

CAT II

CCI(s)

• CCI-000197 - For password-based authentication, transmit passwords only cryptographically-protected channels.
• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.
• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

If the "mail" package is not installed, this is Not Applicable.

Configure Mail Service.

1. From the Admin Console Landing Screen, navigate to Server Settings >> Mail.

2. Enable SSL/TLS:
- If a username and password are required for authentication, check "Enable SSL socket connections to mail server" setting.
- Check "Enable TLS connection to mail server" setting.

3. Mail Spool Settings:
- Uncheck "Spool mail messages for delivery to" setting.

4. Set the "Connection Timeout(in seconds)" setting to 15 seconds or fewer.

5. Mail Logging Settings:
- Check "Log all mail messages sent by ColdFusion setting.
- Select "Warning" for Error Log Severity.

6. Select "Submit Changes" to save the new settings.

Check Contents

If the "mail" package is not installed, this is Not Applicable.

Verify Mail Service Configurations.

From the Admin Console Landing Screen, navigate to Server Settings >> Mail.

If no mail server is configured, this requirement is not a finding.

If a username and password are required for authentication and "Enable TLS connection to mail server" is unchecked and "Enable SSL socket connects to mail server" is unchecked, this is a finding.

If "Spool mail messages for delivery to" is unchecked, this is a finding.

If "Connection Timeout (in seconds)" is set to greater than 15 seconds, this is a finding.

If "Log all mail messages sent by ColdFusion" is not checked, this is a finding.

If the default and recommended setting of "Warning" is not selected for error log severity, this is a finding.

Vulnerability Number

V-279060

Documentable

False

Rule Version

APAS-CF-000355

Severity Override Guidance

If the "mail" package is not installed, this is Not Applicable.

Verify Mail Service Configurations.

From the Admin Console Landing Screen, navigate to Server Settings >> Mail.

If no mail server is configured, this requirement is not a finding.

If a username and password are required for authentication and "Enable TLS connection to mail server" is unchecked and "Enable SSL socket connects to mail server" is unchecked, this is a finding.

If "Spool mail messages for delivery to" is unchecked, this is a finding.

If "Connection Timeout (in seconds)" is set to greater than 15 seconds, this is a finding.

If "Log all mail messages sent by ColdFusion" is not checked, this is a finding.

If the default and recommended setting of "Warning" is not selected for error log severity, this is a finding.

Check Content Reference

M

Target Key

5724