STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

ColdFusion must encrypt patch retrieval.

DISA Rule

SV-279096r1171589_rule

Vulnerability Number

V-279096

Group Title

SRG-APP-000440-AS-000167

Rule Version

APAS-CF-000890

Severity

CAT II

CCI(s)

• CCI-002421 - Implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.

Weight

10

Fix Recommendation

If the Administrator Console is used for patch retrieval:

1. From the Admin Console Landing Screen, navigate to Package Manager >> Settings.

2. Locate the Site URL fields for "Update Site" and "Packages Site".

3. Update each URL to ensure it is prefixed with "https://" so communication is encrypted.

4. Select "Submit Changes".

If a manual process is used to retrieve patches:

1. Develop and maintain documented procedures describing the manual patch retrieval process.

2. Ensure the process specifies using an encrypted method for downloading patches (e.g., VPN tunneling, SCP, or equivalent secure protocols).

Check Contents

Verify that patch retrieval is performed securely, whether automated or manual.

If the Administrator Console is not used to retrieve patches, proceed to Step 2.

1. From the Admin Console Landing Screen, navigate to Package Manager >> Settings.

2. Review the Site URL fields for Update Site and Packages Site. Verify that all URLs are prefixed with "https://".

If any URL is not prefixed with "https://", this is a finding.

3. If patches are retrieved manually, verify there is documented guidance describing the process.

4. Confirm the documented process requires using an encrypted method to download patches, such as VPN tunneling, Secure Copy (SCP), or equivalent secure protocols.

If no documented process exists, or if the process does not require an encrypted method, this is a finding.

Vulnerability Number

V-279096

Documentable

False

Rule Version

APAS-CF-000890

Severity Override Guidance

Verify that patch retrieval is performed securely, whether automated or manual.

If the Administrator Console is not used to retrieve patches, proceed to Step 2.

1. From the Admin Console Landing Screen, navigate to Package Manager >> Settings.

2. Review the Site URL fields for Update Site and Packages Site. Verify that all URLs are prefixed with "https://".

If any URL is not prefixed with "https://", this is a finding.

3. If patches are retrieved manually, verify there is documented guidance describing the process.

4. Confirm the documented process requires using an encrypted method to download patches, such as VPN tunneling, Secure Copy (SCP), or equivalent secure protocols.

If no documented process exists, or if the process does not require an encrypted method, this is a finding.

Check Content Reference

M

Target Key

5724