STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

The ColdFusion error messages must be restricted to only authorized users.

DISA Rule

SV-279072r1170990_rule

Vulnerability Number

V-279072

Group Title

SRG-APP-000267-AS-000170

Rule Version

APAS-CF-000535

Severity

CAT II

CCI(s)

• CCI-001314 - Reveal error messages only to organization-defined personnel or roles.
• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
• CCI-000171 - Allow organization-defined personnel or roles to select the event types that are to be logged by specific components of the system.
• CCI-002314 - Employ automated mechanisms to control remote access methods.
• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure User Roles and Services.

1. From the Admin Console Landing Screen, navigate to Security >> User Manager.

2. Remove any user not approved by the information system security officer (ISSO)/ISSM.

3. Enable only those roles for each user approved by the ISSO/ISSM.

4. Remove the following roles from each user that should not have access to them:
- Debugging and Logging >>Logging.
- Data & Services >> Data Sources.
- Server Settings.

5. Only assign services to those users who require access and only assign those services that are required to perform the user's duties.

Check Contents

Verify User Roles and Services.

1. From the Admin Console Landing Screen, navigate to Security >> User Manager.

2. Review the roles assigned to each user against the information system security manager (ISSM)-approved list of user accounts and roles to determine if any user has excessive authorization.

If users exist that are not approved by the ISSM, this is a finding.

If any user has roles assigned that are not approved by the ISSM, this is a finding.

3. Review each defined user and ask the system administrator (SA) if the user must have access the following roles:
- Debugging and Logging >>Logging.
- Data & Services >> Data Sources.
- Server Settings.

If any users have any of these roles that should not, this is a finding.

4. Review each defined user by using the Edit function. For each user that has values for "Allowed Services", validate with the SA that the user must have remote access to each service.

If there are any users with services that are not required to perform the users' duties, this is a finding.

Vulnerability Number

V-279072

Documentable

False

Rule Version

APAS-CF-000535

Severity Override Guidance

Verify User Roles and Services.

1. From the Admin Console Landing Screen, navigate to Security >> User Manager.

2. Review the roles assigned to each user against the information system security manager (ISSM)-approved list of user accounts and roles to determine if any user has excessive authorization.

If users exist that are not approved by the ISSM, this is a finding.

If any user has roles assigned that are not approved by the ISSM, this is a finding.

3. Review each defined user and ask the system administrator (SA) if the user must have access the following roles:
- Debugging and Logging >>Logging.
- Data & Services >> Data Sources.
- Server Settings.

If any users have any of these roles that should not, this is a finding.

4. Review each defined user by using the Edit function. For each user that has values for "Allowed Services", validate with the SA that the user must have remote access to each service.

If there are any users with services that are not required to perform the users' duties, this is a finding.

Check Content Reference

M

Target Key

5724