What changed in Adobe ColdFusion 11 STIG V2R1V2R1 changes

Adobe ColdFusion 11 STIG V2R1 (2021-07-23) replaced V1R4 (2018-01-26): 100 checks added, 100 removed. It has 100 checks, against 100 in V1R4.

V2R1 checklistV1R4 checklist Compare V1R4 and V2R1 in STIG Compare

  • 100 added
  • 100 removed
  • 0 updated

Added in V2R1 (100)

  • V-237137CAT IIIColdFusion must limit concurrent sessions to the Administrator Console.
  • V-237138CAT IIColdFusion must use cryptography mechanisms to protect the integrity of data sent to the PDF Service.
  • V-237139CAT IColdFusion must implement cryptography mechanisms to protect the integrity of the remote access session.
  • V-237140CAT IIColdFusion must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
  • V-237141CAT IIColdFusion must automatically terminate a user session after user inactivity.
  • V-237142CAT IIColdFusion must set a maximum session time-out value.
  • V-237143CAT IIColdFusion must control remote access to the Administrator Console.
  • V-237144CAT IIColdFusion must control remote access to Exposed Services.
  • V-237145CAT IIColdFusion must control user access to Exposed Services.
  • V-237146CAT IColdFusion must require a username and password for access by each authorized user access.
  • V-237147CAT IIColdFusion must require each user to authenticate with a unique account.
  • V-237148CAT IIWhen ColdFusion is configured in a clustered configuration, ColdFusion must be configured to write log records from the clustered system components into a system-wide log trail that can be correlated.
  • V-237149CAT IIColdFusion must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which logable events are to be logged.
  • V-237150CAT IIIColdFusion must log scheduled tasks.
  • V-237151CAT IIThe ColdFusion log information must be protected from any type of unauthorized read access through the Administrator Console.
  • V-237152CAT IIThe ColdFusion log information must be protected from any type of unauthorized read access by having file permissions set properly.
  • V-237153CAT IIThe ColdFusion log information must be protected from any type of unauthorized modification by having file permissions set properly.
  • V-237154CAT IIThe ColdFusion log information must be protected from any type of unauthorized deletion through the Administrator Console.
  • V-237155CAT IIThe ColdFusion log information must be protected from any type of unauthorized deletion by having file permissions set properly.
  • V-237156CAT IIColdFusion must send log records to the operating system logging facility.
  • V-237157CAT IIColdFusion must allocate log record storage capacity in accordance with organization-defined log record storage requirements.
  • V-237158CAT IIColdFusion log records must be off-loaded onto a different system or media from the system being logged.
  • V-237159CAT IIColdFusion logs must, at a minimum, be transferred simultaneously for interconnected systems and transferred weekly for standalone systems.
  • V-237160CAT IIThe ColdFusion log information must be protected from any type of unauthorized read access by having file ownership set properly.
  • V-237161CAT IIThe ColdFusion log information must be protected from any type of unauthorized modification by having file ownership set properly.
  • V-237162CAT IIThe ColdFusion log information must be protected from any type of unauthorized deletion by having file ownership set properly.
  • V-237163CAT IIColdFusion must limit applications from changing shared Java components.
  • V-237164CAT IIColdFusion must limit privileges, within the Administrator Console, to change the software resident within software libraries.
  • V-237165CAT IIColdFusion must protect software libraries from being changed by OS users.
  • V-237166CAT IIColdFusion must only allow approved file extensions.
  • V-237167CAT IColdFusion must disable Flash Remoting support.
  • V-237168CAT IIColdFusion must disable the In-Memory File System.
  • V-237169CAT IIColdFusion must have Event Gateway Services disabled.
  • V-237170CAT IColdFusion must have Remote Development Services (RDS) disabled.
  • V-237171CAT IIColdFusion must have Remote Adobe LiveCycle Data Management access disabled.
  • V-237172CAT IIColdFusion must have the WebSocket Service disabled.
  • V-237173CAT IIColdFusion must have example data sources removed.
  • V-237174CAT IIThe ColdFusion built-in TomCat Web Server must be disabled.
  • V-237175CAT IColdFusion must have Remote Inspection disabled.
  • V-237176CAT IIColdFusion must protect internal cookies from being updated by hosted applications.
  • V-237177CAT IIColdFusion must prohibit or restrict the use of nonsecure ports, protocols, modules, and/or services as defined in the PPSM CAL and vulnerability assessments.
  • V-237178CAT IIColdFusion must disable auto reloading of configuration files on file changes.
  • V-237179CAT IIThe ColdFusion Root Administrator account must have a unique username.
  • V-237180CAT IIColdFusion must execute as a non-privileged user.
  • V-237181CAT IIColdFusion accounts with access to the Administrator Console must be approved.
  • V-237182CAT IIColdFusion must protect newly created objects.
  • V-237183CAT IIColdFusion must have Sandbox Security enabled.
  • V-237184CAT IIColdFusion must have Sandboxes defined for application execution.
  • V-237185CAT IIColdFusion must have the Default ScriptSrc Directory set to a non-default value.
  • V-237186CAT IUnsupported versions of ColdFusion must be uninstalled or upgraded
  • V-237187CAT IIColdFusion must have example collections removed.
  • V-237188CAT IIColdFusion must have example gateway instances removed.
  • V-237189CAT IIColdFusion must authenticate users individually.
  • V-237190CAT IIColdFusion must provide security extensions to extend the SOAP protocol and provide secure authentication when accessing sensitive data.
  • V-237191CAT IIColdFusion must transmit only encrypted representations of passwords for Flex Integration.
  • V-237192CAT IIThe ColdFusion Administrator Console must transmit only encrypted representations of passwords.
  • V-237193CAT IIColdFusion must transmit only encrypted representations of passwords to the mail server.
  • V-237194CAT IIOnly authenticated system administrators or the designated PKI Sponsor for ColdFusion must have access to ColdFusions private key.
  • V-237195CAT IIThe ColdFusion Administrator Console must be hosted on a management network.
  • V-237196CAT IIThe ColdFusion Administrator Console must be hosted in a management sandbox.
  • V-237197CAT IIColdFusion must disable creation of unnamed applications.
  • V-237198CAT IIColdFusion must not allow application variables to be added to Servlet Context.
  • V-237199CAT IIColdFusion must enable UUID for session identifier generation.
  • V-237200CAT IIColdFusion must use J2EE session variables.
  • V-237201CAT IIColdFusion must set session cookies as browser session cookies.
  • V-237202CAT IIColdFusion must provide a clustering capability.
  • V-237203CAT IIColdFusion must only allow the use of DoD PKI-established certificate authorities for verification of the establishment of protected sessions.
  • V-237204CAT IIColdFusion, when part of a mission critical system, must be in a high-availability (HA) cluster.
  • V-237205CAT IIColdFusion must not store user information in the server registry.
  • V-237206CAT IIColdFusion must limit the maximum number of Flash Remoting requests.
  • V-237207CAT IColdFusion must limit the SQL commands available.
  • V-237208CAT IIColdFusion must set a query timeout for Data Sources.
  • V-237209CAT IIColdFusion must limit the maximum number of Web Service requests.
  • V-237210CAT IIColdFusion must limit the maximum number of CFC function requests.
  • V-237211CAT IIColdFusion must limit the maximum number of simultaneous Report threads.
  • V-237212CAT IIColdFusion must limit the maximum number of threads available for CFTHREAD.
  • V-237213CAT IIColdFusion must set a timeout for requests.
  • V-237214CAT IIColdFusion must set a timeout for logins.
  • V-237215CAT IIColdFusion must limit the time-out for requests waiting in the queue.
  • V-237216CAT IIIColdFusion must have a custom request queue time-out page.
  • V-237217CAT IIColdFusion must limit the maximum number of POST requests parameters.
  • V-237218CAT IIColdFusion must protect the confidentiality and integrity of transmitted information through the use of an approved TLS version.
  • V-237219CAT IIColdFusion must encrypt cookies.
  • V-237220CAT IIColdFusion must employ approved cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.
  • V-237221CAT IIColdFusion must encrypt patch retrieval.
  • V-237222CAT IIColdFusion must protect Session Cookies from being read by scripts.
  • V-237223CAT IColdFusion must prevent JavaScript Object Notation (JSON) hijacking of data.
  • V-237224CAT IIColdFusion must use DoD- or CNSS-approved PKI Class 3 or Class 4 certificates.
  • V-237225CAT IIThe ColdFusion missing template handler must be valid.
  • V-237226CAT IIThe ColdFusion site-wide error handler must be valid.
  • V-237227CAT IColdFusion must have Robust Exception Information disabled.
  • V-237228CAT IColdFusion must have AJAX Debug Log Window disabled.
  • V-237229CAT IColdFusion must have Request Debugging Output disabled.
  • V-237230CAT IColdFusion must have Allow Line Debugging disabled.
  • V-237231CAT IIThe ColdFusion error messages must be restricted to only authorized users.
  • V-237232CAT IIColdFusion must have ColdFusion component (CFC) type checking enabled.
  • V-237233CAT IIColdFusion must enable Global Script Protection.
  • V-237234CAT IIColdFusion must remove software components after updated versions have been installed.
  • V-237235CAT IIIColdFusion must be set to automatically check for updates.
  • V-237236CAT IIIColdFusion must have notifications enabled when a server update is available.

Removed since V1R4 (100)

  • V-62075CAT IIIColdFusion must limit concurrent sessions to the Administrator Console.
  • V-62349CAT IIColdFusion must use cryptography mechanisms to protect the integrity of data sent to the PDF Service.
  • V-62351CAT IColdFusion must implement cryptography mechanisms to protect the integrity of the remote access session.
  • V-62353CAT IIColdFusion must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
  • V-62355CAT IIColdFusion must automatically terminate a user session after user inactivity.
  • V-62357CAT IIColdFusion must set a maximum session time-out value.
  • V-62359CAT IIColdFusion must control remote access to the Administrator Console.
  • V-62361CAT IIColdFusion must control remote access to Exposed Services.
  • V-62363CAT IIColdFusion must control user access to Exposed Services.
  • V-62365CAT IColdFusion must require a username and password for access by each authorized user access.
  • V-62367CAT IIColdFusion must require each user to authenticate with a unique account.
  • V-62369CAT IIWhen ColdFusion is configured in a clustered configuration, ColdFusion must be configured to write log records from the clustered system components into a system-wide log trail that can be correlated.
  • V-62371CAT IIColdFusion must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which logable events are to be logged.
  • V-62373CAT IIIColdFusion must log scheduled tasks.
  • V-62375CAT IIThe ColdFusion log information must be protected from any type of unauthorized read access through the Administrator Console.
  • V-62377CAT IIThe ColdFusion log information must be protected from any type of unauthorized read access by having file permissions set properly.
  • V-62379CAT IIThe ColdFusion log information must be protected from any type of unauthorized modification by having file permissions set properly.
  • V-62381CAT IIThe ColdFusion log information must be protected from any type of unauthorized deletion through the Administrator Console.
  • V-62383CAT IIThe ColdFusion log information must be protected from any type of unauthorized deletion by having file permissions set properly.
  • V-62385CAT IIColdFusion must send log records to the operating system logging facility.
  • V-62387CAT IIColdFusion must allocate log record storage capacity in accordance with organization-defined log record storage requirements.
  • V-62389CAT IIColdFusion log records must be off-loaded onto a different system or media from the system being logged.
  • V-62391CAT IIColdFusion logs must, at a minimum, be transferred simultaneously for interconnected systems and transferred weekly for standalone systems.
  • V-62393CAT IIThe ColdFusion log information must be protected from any type of unauthorized read access by having file ownership set properly.
  • V-62395CAT IIThe ColdFusion log information must be protected from any type of unauthorized modification by having file ownership set properly.
  • V-62397CAT IIThe ColdFusion log information must be protected from any type of unauthorized deletion by having file ownership set properly.
  • V-62399CAT IIColdFusion must limit applications from changing shared Java components.
  • V-62401CAT IIColdFusion must limit privileges, within the Administrator Console, to change the software resident within software libraries.
  • V-62403CAT IIColdFusion must protect software libraries from being changed by OS users.
  • V-62405CAT IIColdFusion must only allow approved file extensions.
  • V-62407CAT IColdFusion must disable Flash Remoting support.
  • V-62409CAT IIColdFusion must disable the In-Memory File System.
  • V-62411CAT IIColdFusion must have Event Gateway Services disabled.
  • V-62413CAT IColdFusion must have Remote Development Services (RDS) disabled.
  • V-62415CAT IIColdFusion must have Remote Adobe LiveCycle Data Management access disabled.
  • V-62417CAT IIColdFusion must have the WebSocket Service disabled.
  • V-62419CAT IIColdFusion must have example data sources removed.
  • V-62421CAT IIThe ColdFusion built-in TomCat Web Server must be disabled.
  • V-62423CAT IColdFusion must have Remote Inspection disabled.
  • V-62425CAT IIColdFusion must protect internal cookies from being updated by hosted applications.
  • V-62427CAT IIColdFusion must prohibit or restrict the use of nonsecure ports, protocols, modules, and/or services as defined in the PPSM CAL and vulnerability assessments.
  • V-62429CAT IIColdFusion must disable auto reloading of configuration files on file changes.
  • V-62431CAT IIThe ColdFusion Root Administrator account must have a unique username.
  • V-62433CAT IIColdFusion must execute as a non-privileged user.
  • V-62435CAT IIColdFusion accounts with access to the Administrator Console must be approved.
  • V-62437CAT IIColdFusion must protect newly created objects.
  • V-62439CAT IIColdFusion must have Sandbox Security enabled.
  • V-62441CAT IIColdFusion must have Sandboxes defined for application execution.
  • V-62443CAT IIColdFusion must have the Default ScriptSrc Directory set to a non-default value.
  • V-62445CAT IColdFusion must contain the most recent update.
  • V-62447CAT IIColdFusion must have example collections removed.
  • V-62449CAT IIColdFusion must have example gateway instances removed.
  • V-62451CAT IIColdFusion must authenticate users individually.
  • V-62453CAT IIColdFusion must provide security extensions to extend the SOAP protocol and provide secure authentication when accessing sensitive data.
  • V-62455CAT IIColdFusion must transmit only encrypted representations of passwords for Flex Integration.
  • V-62457CAT IIThe ColdFusion Administrator Console must transmit only encrypted representations of passwords.
  • V-62459CAT IIColdFusion must transmit only encrypted representations of passwords to the mail server.
  • V-62461CAT IIOnly authenticated system administrators or the designated PKI Sponsor for ColdFusion must have access to ColdFusions private key.
  • V-62463CAT IIThe ColdFusion Administrator Console must be hosted on a management network.
  • V-62465CAT IIThe ColdFusion Administrator Console must be hosted in a management sandbox.
  • V-62467CAT IIColdFusion must disable creation of unnamed applications.
  • V-62469CAT IIColdFusion must not allow application variables to be added to Servlet Context.
  • V-62471CAT IIColdFusion must enable UUID for session identifier generation.
  • V-62473CAT IIColdFusion must use J2EE session variables.
  • V-62475CAT IIColdFusion must set session cookies as browser session cookies.
  • V-62477CAT IIColdFusion must provide a clustering capability.
  • V-62479CAT IIColdFusion must only allow the use of DoD PKI-established certificate authorities for verification of the establishment of protected sessions.
  • V-62481CAT IIColdFusion, when part of a mission critical system, must be in a high-availability (HA) cluster.
  • V-62483CAT IIColdFusion must not store user information in the server registry.
  • V-62485CAT IIColdFusion must limit the maximum number of Flash Remoting requests.
  • V-62487CAT IColdFusion must limit the SQL commands available.
  • V-62489CAT IIColdFusion must set a query timeout for Data Sources.
  • V-62491CAT IIColdFusion must limit the maximum number of Web Service requests.
  • V-62493CAT IIColdFusion must limit the maximum number of CFC function requests.
  • V-62495CAT IIColdFusion must limit the maximum number of simultaneous Report threads.
  • V-62497CAT IIColdFusion must limit the maximum number of threads available for CFTHREAD.
  • V-62499CAT IIColdFusion must set a timeout for requests.
  • V-62501CAT IIColdFusion must set a timeout for logins.
  • V-62503CAT IIColdFusion must limit the time-out for requests waiting in the queue.
  • V-62505CAT IIIColdFusion must have a custom request queue time-out page.
  • V-62507CAT IIColdFusion must limit the maximum number of POST requests parameters.
  • V-62509CAT IIColdFusion must protect the confidentiality and integrity of transmitted information through the use of an approved TLS version.
  • V-62511CAT IIColdFusion must encrypt cookies.
  • V-62513CAT IIColdFusion must employ approved cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.
  • V-62515CAT IIColdFusion must encrypt patch retrieval.
  • V-62517CAT IIColdFusion must protect Session Cookies from being read by scripts.
  • V-62519CAT IColdFusion must prevent JavaScript Object Notation (JSON) hijacking of data.
  • V-62521CAT IIColdFusion must use DoD- or CNSS-approved PKI Class 3 or Class 4 certificates.
  • V-62523CAT IIThe ColdFusion missing template handler must be valid.
  • V-62525CAT IIThe ColdFusion site-wide error handler must be valid.
  • V-62527CAT IColdFusion must have Robust Exception Information disabled.
  • V-62529CAT IColdFusion must have AJAX Debug Log Window disabled.
  • V-62531CAT IColdFusion must have Request Debugging Output disabled.
  • V-62533CAT IColdFusion must have Allow Line Debugging disabled.
  • V-62535CAT IIThe ColdFusion error messages must be restricted to only authorized users.
  • V-62537CAT IIColdFusion must have ColdFusion component (CFC) type checking enabled.
  • V-62539CAT IIColdFusion must enable Global Script Protection.
  • V-62541CAT IIColdFusion must remove software components after updated versions have been installed.
  • V-62543CAT IIIColdFusion must be set to automatically check for updates.
  • V-62545CAT IIIColdFusion must have notifications enabled when a server update is available.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V2R1 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.