STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

ColdFusion must separate the hosted application from the web server.

DISA Rule

SV-279066r1171607_rule

Vulnerability Number

V-279066

Group Title

SRG-APP-000211-AS-000146

Rule Version

APAS-CF-000430

Severity

CAT II

CCI(s)

• CCI-001082 - Separate user functionality, including user interface services, from system management functionality.

Weight

10

Fix Recommendation

If a separate web server is used for hosted applications, requirement is Not Applicable.

1. Set up the web server.

For Linux:
Execute the Web Server Configuration tool. In the ColdFusion install folder, find:
<ColdFusion_Installation_Directory> /cfusion/runtime/bin/wsconfig

For Windows:
In the ColdFusion install folder, find:
<ColdFusion_Installation_Directory> \cfusion\runtime\bin\wsconfig.exe

2. In the tool, click "Add".

3. Provide the application server host, instance, and cluster.

4. Enter the appropriate Web Server Properties.

5. Select "OK".

6. Set up separate instances.

a. From the Admin Console Landing Screen, navigate to Enterprise Manager >> Instance Manager.

b. Select "Add New Instance".

c. Enter a server name.

d. Choose a directory.

e. Select "Submit".

Check Contents

If a separate web server is used for hosted applications, requirement is Not Applicable.

1. From the Admin Console Landing Screen., navigate to Enterprise Manager >> Instance Manager.

If all of the hosted applications have their own instance(s) under "Available Servers", this is not a finding.

If neither web servers nor separate instances are being used, this is a finding.

Vulnerability Number

V-279066

Documentable

False

Rule Version

APAS-CF-000430

Severity Override Guidance

If a separate web server is used for hosted applications, requirement is Not Applicable.

1. From the Admin Console Landing Screen., navigate to Enterprise Manager >> Instance Manager.

If all of the hosted applications have their own instance(s) under "Available Servers", this is not a finding.

If neither web servers nor separate instances are being used, this is a finding.

Check Content Reference

M

Target Key

5724