V-279066

Discussion

Separating hosted ColdFusion applications from the web server is critical for enforcing strong access control and minimizing the risk of unauthorized access to sensitive server components. When hosted applications and the web server operate within the same execution context or process space, vulnerabilities in one can directly compromise the other. Separating the hosted application logic from the core web server components limits the application's access to only the resources it requires. This containment ensures that application-level vulnerabilities cannot be easily escalated to affect the broader server environment. It also allows for more granular security controls, input validation, and auditing. This separation supports defense-in-depth by establishing clear trust boundaries between application and server functions. It enforces the principle of least privilege, protects critical infrastructure from exploitation.

Check Content

If a separate web server is used for hosted applications, requirement is Not Applicable.

1. From the Admin Console Landing Screen., navigate to Enterprise Manager >> Instance Manager.

If all of the hosted applications have their own instance(s) under "Available Servers", this is not a finding.

If neither web servers nor separate instances are being used, this is a finding.