STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

ColdFusion must be configured to enable Cross-Origin Resource Sharing (CORS) to allow mobile applications to access resources from different origins securely.

DISA Rule

SV-279107r1208176_rule

Vulnerability Number

V-279107

Group Title

SRG-APP-000516-AS-000237

Rule Version

APAS-CF-001055

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.
• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

Configure Mobile Services settings.

If hosted applications are not using the service, this is not a finding.

1. From the Admin Console Landing Screen, navigate to Server Settings >> Settings.

2. Uncheck "Enable mobile's server workflow" if it is checked.

3. Enable CORS to address this finding if it is not already enabled.

4. Update the mobile server context to a value other than "cfmobile" if it is currently set to "cfmobile".

5. Select "Submit Changes".

Check Contents

Validate Mobile Services settings.

If hosted applications are not using the service, this is not a finding.

1. Ask the administrator if ColdFusion Mobile services are being used by any hosted applications.

If hosted applications are using the service, this is not a finding.

2. From the Admin Console Landing Screen, navigate to Server Settings >> Settings.

If "Enable mobile's server workflow" is checked, this is a finding.

3. Review the "Enable CORS" setting.

If CORS is not enabled, this is a finding.

4. Review the "Mobile server context" setting.

If the mobile server context is set to "cfmobile", this is a finding.

Vulnerability Number

V-279107

Documentable

False

Rule Version

APAS-CF-001055

Severity Override Guidance

Validate Mobile Services settings.

If hosted applications are not using the service, this is not a finding.

1. Ask the administrator if ColdFusion Mobile services are being used by any hosted applications.

If hosted applications are using the service, this is not a finding.

2. From the Admin Console Landing Screen, navigate to Server Settings >> Settings.

If "Enable mobile's server workflow" is checked, this is a finding.

3. Review the "Enable CORS" setting.

If CORS is not enabled, this is a finding.

4. Review the "Mobile server context" setting.

If the mobile server context is set to "cfmobile", this is a finding.

Check Content Reference

M

Target Key

5724