V-279061

Discussion

Redis is an in-memory data structure store used as a database, cache, and message broker. When data is transmitted between ColdFusion and the Redis caching server without encryption, it is vulnerable to interception and unauthorized access. This can lead to the exposure of sensitive information, including cached data, session information, and other confidential data. By requiring the Redis caching server connection to use encryption for data transmission, ColdFusion ensures that the credentials and data are protected from eavesdropping and tampering. This practice helps maintain the confidentiality and integrity of the data, thereby enhancing the overall security of the server and the applications it hosts. Regularly verifying and enforcing with encryption for all Redis caching server connections is essential for maintaining a secure server environment.

Check Content

Verify Redis Cache encryption.

From the Admin Console Landing Screen, navigate to Server Settings >> Caching.

If the "Redis Server" setting is "localhost" or blank, this requirement is not a finding.

If "Password" is blank, this is not a finding.

If "Is SSL Enabled" is unchecked, this is a finding.