STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

ColdFusion must have the Tomcat DefaultServlet debug parameter disabled.

DISA Rule

SV-279071r1171608_rule

Vulnerability Number

V-279071

Group Title

SRG-APP-000266-AS-000169

Rule Version

APAS-CF-000510

Severity

CAT II

CCI(s)

• CCI-001312 - Generates error messages that provide information necessary for corrective actions without revealing information that could be exploited.

Weight

10

Fix Recommendation

Configure DefaultServlet to disable debug output.

1. Open the web.xml file located at:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf\web.xml

2. Locate the DefaultServlet definition and ensure the debug parameter is set as follows:

<init-param>
<param-name>debug</param-name>
<param-value>0</param-value>
</init-param>

3. Save the changes and restart ColdFusion to apply the configuration.

Check Contents

Review the debug parameter for the DefaultServlet and verify it is disabled.

1. Locate the web.xml file for each ColdFusion instance located at:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf\web.xml

2. Open the web.xml file in a text editor.

3. Search for the following servlet definition:

<servlet>
<servlet-name>default</servlet-name>
<servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>

4. Within this block, locate the <init-param> with the <param-name>debug</param-name> element.

5. Verify the corresponding <param-value> is set to 0. For example:
<init-param>
<param-name>debug</param-name>
<param-value>0</param-value>
</init-param>

If the debug parameter is set to any value other than 0, or is not explicitly defined, this is a finding.

Vulnerability Number

V-279071

Documentable

False

Rule Version

APAS-CF-000510

Severity Override Guidance

Review the debug parameter for the DefaultServlet and verify it is disabled.

1. Locate the web.xml file for each ColdFusion instance located at:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf\web.xml

2. Open the web.xml file in a text editor.

3. Search for the following servlet definition:

<servlet>
<servlet-name>default</servlet-name>
<servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>

4. Within this block, locate the <init-param> with the <param-name>debug</param-name> element.

5. Verify the corresponding <param-value> is set to 0. For example:
<init-param>
<param-name>debug</param-name>
<param-value>0</param-value>
</init-param>

If the debug parameter is set to any value other than 0, or is not explicitly defined, this is a finding.

Check Content Reference

M

Target Key

5724