STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

ColdFusion must be configured to set the cookie settings.

DISA Rule

SV-279106r1171597_rule

Vulnerability Number

V-279106

Group Title

SRG-APP-000516-AS-000237

Rule Version

APAS-CF-001030

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.
• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.
• CCI-002418 - Protect the confidentiality and/or integrity of transmitted information.
• CCI-002420 - Maintain the confidentiality and/or integrity of information during preparation for transmission.

Weight

10

Fix Recommendation

Configure Session Cookie Settings.

1. From the Admin Console Landing Screen, navigate to Server Settings >> Memory Variables >> Session Cookie Settings.

2. If the Cookie Timeout is not set to -1, update the setting to -1 to ensure session cookies do not expire prematurely.

3. If "Disable updating ColdFusion internal cookies using ColdFusion tags/functions." is not checked, enable this setting to prevent unauthorized modification of internal cookies.

4. If the "Cookie Samesite default value" is not set to "Lax" or "Strict", configure it to one of these values to enhance security against cross-site request forgery (CSRF) attacks.

5. Select "Submit Changes".

Check Contents

Verify Session Cookie Settings.

From the Admin Console Landing Screen, navigate to Server Settings >> Memory Variables >> Session Cookie Settings.

If the Cookie Timeout is not set to "-1", this is a finding.

If "Disable updating ColdFusion internal cookies using ColdFusion tags/functions" is not checked, this is a finding.

If the "Cookie Samesite default value" is not set to "Lax" or "Strict" for a default value, this is a finding.

Vulnerability Number

V-279106

Documentable

False

Rule Version

APAS-CF-001030

Severity Override Guidance

Verify Session Cookie Settings.

From the Admin Console Landing Screen, navigate to Server Settings >> Memory Variables >> Session Cookie Settings.

If the Cookie Timeout is not set to "-1", this is a finding.

If "Disable updating ColdFusion internal cookies using ColdFusion tags/functions" is not checked, this is a finding.

If the "Cookie Samesite default value" is not set to "Lax" or "Strict" for a default value, this is a finding.

Check Content Reference

M

Target Key

5724