STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

ColdFusion must be configured to mutually authenticate connecting proxies and load balancers.

DISA Rule

SV-279067r1171547_rule

Vulnerability Number

V-279067

Group Title

SRG-APP-000219-AS-000147

Rule Version

APAS-CF-000445

Severity

CAT II

CCI(s)

• CCI-001184 - Protect the authenticity of communications sessions.

Weight

10

Fix Recommendation

Configure SSL Certificate.

For server.xml:
1. For each ColdFusion instance, navigate to:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf\server.xml

2. Before making changes, back up the file to prevent accidental misconfiguration.

3. Open server.xml in a text editor with administrative privileges.

For web.xml:
1. For each ColdFusion instance, navigate to:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf\web.xml

2. Before making changes, back up the file to prevent accidental misconfiguration.

3. Open web.xml in a text editor with administrative privileges.

4. Ensure the <login-config><auth-method>CLIENT-CERT</auth-method></login-config> is present under the web-app tag.

5. Save and close the file. Restart ColdFusion to apply the changes.

Check Contents

Validate SSL Certificate.

1. Identify any proxy servers or load balancers that provide services for the Tomcat server. If there are no load balancers or proxies in use, this is not a finding.

2. Identify each ColdFusion IP address that is served by a load balancer or proxy. Locate the configuration file. For each ColdFusion instance, navigate to:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf\server.xml

3. Open the server.xml file in a text editor and review each <Connector> element for the address setting and the clientAuth setting.

If a connector has a configured IP address that is proxied or load balanced and the clientAuth setting is not "true", this is a finding.

4. Locate the configuration file. For each ColdFusion instance, navigate to:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf\web.xml

5. Open the web.xml file in a text editor.

If "<login-config><auth-method>CLIENT-CERT</auth-method></login-config>" is not present under the web-app tag, this is a finding.

Vulnerability Number

V-279067

Documentable

False

Rule Version

APAS-CF-000445

Severity Override Guidance

Validate SSL Certificate.

1. Identify any proxy servers or load balancers that provide services for the Tomcat server. If there are no load balancers or proxies in use, this is not a finding.

2. Identify each ColdFusion IP address that is served by a load balancer or proxy. Locate the configuration file. For each ColdFusion instance, navigate to:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf\server.xml

3. Open the server.xml file in a text editor and review each <Connector> element for the address setting and the clientAuth setting.

If a connector has a configured IP address that is proxied or load balanced and the clientAuth setting is not "true", this is a finding.

4. Locate the configuration file. For each ColdFusion instance, navigate to:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf\web.xml

5. Open the web.xml file in a text editor.

If "<login-config><auth-method>CLIENT-CERT</auth-method></login-config>" is not present under the web-app tag, this is a finding.

Check Content Reference

M

Target Key

5724