STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

ColdFusion must configure Data Sources to limit SQL command and configure timeout.

DISA Rule

SV-279083r1171449_rule

Vulnerability Number

V-279083

Group Title

SRG-APP-000435-AS-000163

Rule Version

APAS-CF-000755

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.
• CCI-000197 - For password-based authentication, transmit passwords only cryptographically-protected channels.

Weight

10

Fix Recommendation

Configure data sources.

1. From the Admin Console Landing Screen, navigate to Data & Services >> Data Sources.

2. For each data source, edit the data source configuration:

a. Click "Show Advanced Settings" to display all options.

b. If the query timeout parameter is available, set the timeout value to a number greater than 0 to ensure queries do not run indefinitely.

c. Set "Login Timeout (sec)" to less than 5.

d. Uncheck the options allowing SQL commands:
CREATE
GRANT
DROP
REVOKE
ALTER

d. Click "Submit" to save changes.

Check Contents

Verify that all defined data sources are configured.

1. From the Admin Console Landing Screen, navigate to Data & Services >> Data Sources.

2. Determine if any data sources are defined.

If no data sources are defined, this is not a finding.

3. For each Connected Data Source, edit the data source by clicking "Show Advanced Settings" to display all configuration options.

4. Check whether the data source provides an option to specify a query timeout.

If the query timeout setting is not available, this is not a finding.

5. If the query timeout setting is available, verify that the value is not set to "0", which indicates no timeout.

If any data source has a query timeout configured with a value of "0", this is a finding.

6. Review "Login Timeout (sec)".

If there are any data sources with a "Login Timeout (sec)" set higher than 5, this is a finding.

If any of the data sources have CREATE, GRANT, DROP, REVOKE or ALTER checked, this is a finding.

Vulnerability Number

V-279083

Documentable

False

Rule Version

APAS-CF-000755

Severity Override Guidance

Verify that all defined data sources are configured.

1. From the Admin Console Landing Screen, navigate to Data & Services >> Data Sources.

2. Determine if any data sources are defined.

If no data sources are defined, this is not a finding.

3. For each Connected Data Source, edit the data source by clicking "Show Advanced Settings" to display all configuration options.

4. Check whether the data source provides an option to specify a query timeout.

If the query timeout setting is not available, this is not a finding.

5. If the query timeout setting is available, verify that the value is not set to "0", which indicates no timeout.

If any data source has a query timeout configured with a value of "0", this is a finding.

6. Review "Login Timeout (sec)".

If there are any data sources with a "Login Timeout (sec)" set higher than 5, this is a finding.

If any of the data sources have CREATE, GRANT, DROP, REVOKE or ALTER checked, this is a finding.

Check Content Reference

M

Target Key

5724