STIGhubSTIGhub
STIGsSearchCompareAbout

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • VPAT
  • DISA STIG Library
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to Adobe ColdFusion Security Technical Implementation Guide

V-279098

CAT II (Medium)

The ColdFusion administrator must be using HTTPS to maintain the confidentiality and integrity of information during reception.

Rule ID

SV-279098r1172830_rule

STIG

Adobe ColdFusion Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-002422

Discussion

Information can be either unintentionally or maliciously disclosed or modified during reception, including, for example, during aggregation, at protocol transformation points and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. ColdFusion must use approved encryption when receiving transmitted data by configuring the Tomcat Connector to use HTTPS.

Check Content

Verify HTTPS.

1. Locate the server.xml file for each ColdFusion instance located at: <ColdFusion_Installation_Directory>\cfusion\runtime\conf\

2. Open the server.xml file in a text editor.

3. Locate all <Connector> elements configured with an HTTP protocol (e.g., protocol="org.apache.coyote.http11.Http11Protocol" or Http11NioProtocol).

If any HTTP connector exists without SSLEnabled="true" and is not commented out (<!-- ... -->), this is a finding.

If there is no active (uncommented) <Connector> configured with SSLEnabled="true", scheme="https", and secure="true", this is a finding.

Fix Text

Configure ColdFusion to use HTTPS and disable unsecured HTTP access.

1. Locate the server.xml file for each ColdFusion instance located at: <ColdFusion_Installation_Directory>\cfusion\runtime\conf\

2. Open the server.xml file in a text editor.

3. Locate all <Connector> elements using the HTTP protocol (e.g., protocol="org.apache.coyote.http11.Http11Protocol" or Http11NioProtocol) without the attribute SSLEnabled="true"

4. Either delete these unsecured <Connector> tags or comment them out using XML syntax:

<!-- <Connector port="8500" protocol="org.apache.coyote.http11.Http11Protocol" ... /> -->

5. Locate a <Connector> tag that includes SSLEnabled="true" and is configured to support HTTPS communication.

6. If this tag is present but commented out, uncomment it by removing the <!-- and --> markers.

7. If a secure HTTPS connector does not exist, create a new <Connector> tag within the <Service> element of the server.xml file. It should include the following attributes:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
           clientAuth="false" keystoreFile="/path/to/keystore" keystorePass="changeit"/>

8. Replace /path/to/keystore with the actual path to the keystore file. 

9. Replace "changeit" with the actual password for the keystore.

10. Save the file and restart ColdFusion for the changes to take effect.