STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

ColdFusion must generate a unique session identifier using a FIPS 140-2/140-3 or higher approved random number generator.

DISA Rule

SV-279068r1172825_rule

Vulnerability Number

V-279068

Group Title

SRG-APP-000224-AS-000152

Rule Version

APAS-CF-000465

Severity

CAT I

CCI(s)

• CCI-001188 - Generate a unique session identifier for each session with organization-defined randomness requirements.

Weight

10

Fix Recommendation

Configure the random number generator for generating session identifiers.

1. Open the java.security file located at: <ColdFusion_Installation_Directory>\jre\conf\security\java.security

2. Locate or add the securerandom.strongAlgorithms property and configure it to use a FIPS-approved RNG. For example:
securerandom.strongAlgorithms=DRBG:SUN

3. Save the file and restart ColdFusion to apply changes.

Check Contents

Review the random number generator for generating session identifiers.

1. Locate the java.security file for the Java Runtime Environment (JRE) used by ColdFusion located at:
<ColdFusion_Installation_Directory>\jre\conf\security\java.security

2. Open the java.security file in a text editor.

3. Locate the following setting:
securerandom.strongAlgorithms

4. Verify that the value includes a FIPS 140-2/140-3 or higher approved random number generator. For example:
securerandom.strongAlgorithms=DRBG:SUN

If the securerandom.strongAlgorithms setting does not exist or does not specify a FIPS 140-2/140-3 or higher approved algorithm, this is a finding.

Vulnerability Number

V-279068

Documentable

False

Rule Version

APAS-CF-000465

Severity Override Guidance

Review the random number generator for generating session identifiers.

1. Locate the java.security file for the Java Runtime Environment (JRE) used by ColdFusion located at:
<ColdFusion_Installation_Directory>\jre\conf\security\java.security

2. Open the java.security file in a text editor.

3. Locate the following setting:
securerandom.strongAlgorithms

4. Verify that the value includes a FIPS 140-2/140-3 or higher approved random number generator. For example:
securerandom.strongAlgorithms=DRBG:SUN

If the securerandom.strongAlgorithms setting does not exist or does not specify a FIPS 140-2/140-3 or higher approved algorithm, this is a finding.

Check Content Reference

M

Target Key

5724