STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

ColdFusion must record time stamps for log records that can be mapped system time.

DISA Rule

SV-279077r1171570_rule

Vulnerability Number

V-279077

Group Title

SRG-APP-000374-AS-000210

Rule Version

APAS-CF-000640

Severity

CAT II

CCI(s)

• CCI-001890 - Record time stamps for audit records that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.

Weight

10

Fix Recommendation

Configure JVM Arguments for Time zone.

1. From the Admin Console Landing Screen, navigate to Server Settings >> Java and JVM.

2. Add the argument as:
"Duser.timezone=<TIMEZONE>"
(If the parameter is already defined, change the setting to "<TIMEZONE>".)

3. Select "Submit Changes".

Check Contents

Verify JVM Arguments for Time zone.

From the Admin Console Landing Screen, navigate to Server Settings >> Java and JVM.

If the JVM argument -"Duser.timezone=<TIMEZONE>" cannot be found , this is a finding.

Vulnerability Number

V-279077

Documentable

False

Rule Version

APAS-CF-000640

Severity Override Guidance

Verify JVM Arguments for Time zone.

From the Admin Console Landing Screen, navigate to Server Settings >> Java and JVM.

If the JVM argument -"Duser.timezone=<TIMEZONE>" cannot be found , this is a finding.

Check Content Reference

M

Target Key

5724