STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

ColdFusion must set Request Tuning configurations.

DISA Rule

SV-279079r1171576_rule

Vulnerability Number

V-279079

Group Title

SRG-APP-000435-AS-000163

Rule Version

APAS-CF-000735

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Set Request Tuning Configurations.

1. From the Admin Console Landing Screen, navigate to Server Settings >> Request Tuning.

2. Set "Maximum number of simultaneous Report threads" to "1".

3. Set "Maximum number of simultaneous Template requests" to the appropriate amount or 24, whichever is higher.

4. Set "Timeout requests waiting in queue after" to "5" or fewer.

5. Set "Request Queue Timeout Page" to a custom and valid page.

6. Select "Submit Changes".

Check Contents

Verify Request Tuning Configurations.

1. From the Admin Console Landing Screen, navigate to Server Settings >> Request Tuning.

If "Maximum number of simultaneous Report threads" is not set to "1", this is a finding.

If the "Maximum number of simultaneous Template requests" is not set to the maximum number of requests (or 24, whichever is higher), this is a finding.

If "Timeout requests waiting in queue after" setting is higher than "5", this is a finding.

2. Validate that "Request Queue Timeout Page" is set to a valid and custom page.

If "Request Queue Timeout Page" is blank or is set to "/CFIDE/administrator/templates/request_timeout_error.cfm", this is a finding.

3. Validate the file exists. The path and file given are relevant to the web servers' document root directory and not the OS root directory. For example, if the web servers' document root is /opt/webserver/wwwroot and the "Request Queue Timeout Page" is set to /CFIDE/administrator/templates/timeout_error.cfm, the full path to the template file is /opt/webserver/wwwroot/CFIDE/administrator/templates/timeout_error.cfm.

If the "Request Queue Timeout Page" setting is not set to a valid page, this is a finding.

Vulnerability Number

V-279079

Documentable

False

Rule Version

APAS-CF-000735

Severity Override Guidance

Verify Request Tuning Configurations.

1. From the Admin Console Landing Screen, navigate to Server Settings >> Request Tuning.

If "Maximum number of simultaneous Report threads" is not set to "1", this is a finding.

If the "Maximum number of simultaneous Template requests" is not set to the maximum number of requests (or 24, whichever is higher), this is a finding.

If "Timeout requests waiting in queue after" setting is higher than "5", this is a finding.

2. Validate that "Request Queue Timeout Page" is set to a valid and custom page.

If "Request Queue Timeout Page" is blank or is set to "/CFIDE/administrator/templates/request_timeout_error.cfm", this is a finding.

3. Validate the file exists. The path and file given are relevant to the web servers' document root directory and not the OS root directory. For example, if the web servers' document root is /opt/webserver/wwwroot and the "Request Queue Timeout Page" is set to /CFIDE/administrator/templates/timeout_error.cfm, the full path to the template file is /opt/webserver/wwwroot/CFIDE/administrator/templates/timeout_error.cfm.

If the "Request Queue Timeout Page" setting is not set to a valid page, this is a finding.

Check Content Reference

M

Target Key

5724