STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

The ColdFusion administrator must be using HTTPS to maintain the confidentiality and integrity of information during reception.

DISA Rule

SV-279098r1172830_rule

Vulnerability Number

V-279098

Group Title

SRG-APP-000442-AS-000259

Rule Version

APAS-CF-000910

Severity

CAT II

CCI(s)

• CCI-002422 - Maintain the confidentiality and/or integrity of information during reception.

Weight

10

Fix Recommendation

Configure ColdFusion to use HTTPS and disable unsecured HTTP access.

1. Locate the server.xml file for each ColdFusion instance located at: <ColdFusion_Installation_Directory>\cfusion\runtime\conf\

2. Open the server.xml file in a text editor.

3. Locate all <Connector> elements using the HTTP protocol (e.g., protocol="org.apache.coyote.http11.Http11Protocol" or Http11NioProtocol) without the attribute SSLEnabled="true"

4. Either delete these unsecured <Connector> tags or comment them out using XML syntax:

<!-- <Connector port="8500" protocol="org.apache.coyote.http11.Http11Protocol" ... /> -->

5. Locate a <Connector> tag that includes SSLEnabled="true" and is configured to support HTTPS communication.

6. If this tag is present but commented out, uncomment it by removing the <!-- and --> markers.

7. If a secure HTTPS connector does not exist, create a new <Connector> tag within the <Service> element of the server.xml file. It should include the following attributes:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
clientAuth="false" keystoreFile="/path/to/keystore" keystorePass="changeit"/>

8. Replace /path/to/keystore with the actual path to the keystore file.

9. Replace "changeit" with the actual password for the keystore.

10. Save the file and restart ColdFusion for the changes to take effect.

Check Contents

Verify HTTPS.

1. Locate the server.xml file for each ColdFusion instance located at: <ColdFusion_Installation_Directory>\cfusion\runtime\conf\

2. Open the server.xml file in a text editor.

3. Locate all <Connector> elements configured with an HTTP protocol (e.g., protocol="org.apache.coyote.http11.Http11Protocol" or Http11NioProtocol).

If any HTTP connector exists without SSLEnabled="true" and is not commented out (<!-- ... -->), this is a finding.

If there is no active (uncommented) <Connector> configured with SSLEnabled="true", scheme="https", and secure="true", this is a finding.

Vulnerability Number

V-279098

Documentable

False

Rule Version

APAS-CF-000910

Severity Override Guidance

Verify HTTPS.

1. Locate the server.xml file for each ColdFusion instance located at: <ColdFusion_Installation_Directory>\cfusion\runtime\conf\

2. Open the server.xml file in a text editor.

3. Locate all <Connector> elements configured with an HTTP protocol (e.g., protocol="org.apache.coyote.http11.Http11Protocol" or Http11NioProtocol).

If any HTTP connector exists without SSLEnabled="true" and is not commented out (<!-- ... -->), this is a finding.

If there is no active (uncommented) <Connector> configured with SSLEnabled="true", scheme="https", and secure="true", this is a finding.

Check Content Reference

M

Target Key

5724