ColdFusion must require enforced authentication.

ColdFusion must require each authorized user to authenticate and not allow multiple users. Without enforced authentication, there is no reliable method to verify the identity of users accessing the ColdFusion Administrator Console or other secured components of the application server. This lack of accountability can allow unauthorized users to gain elevated privileges, make unauthorized changes, or conceal malicious activity. Requiring a username and password for each user aligns with the principles of least privilege and ensures that access to sensitive configuration and management functions is appropriately controlled.

1. From the Admin Console Landing Screen, navigate to Security >> Administrator.

2. If the "Separate user name and password authentication (allows multiple users)" is not selected, this is a finding.

1. From the Admin Console Landing Screen, navigate to Security >> Administrator.

2. Select "Separate user name and password authentication (allows multiple users)".

3. Select "Submit Changes".