The ColdFusion administrator must be using HTTPS to maintain the confidentiality and integrity of information during reception.

Information can be either unintentionally or maliciously disclosed or modified during reception, including, for example, during aggregation, at protocol transformation points and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information.

ColdFusion must use approved encryption when receiving transmitted data by configuring the Tomcat Connector to use HTTPS.

Verify HTTPS.

1. Locate the server.xml file for each ColdFusion instance located at: <ColdFusion_Installation_Directory>\cfusion\runtime\conf\

2. Open the server.xml file in a text editor.

3. Locate all <Connector> elements configured with an HTTP protocol (e.g., protocol="org.apache.coyote.http11.Http11Protocol" or Http11NioProtocol).

If any HTTP connector exists without SSLEnabled="true" and is not commented out (<!-- ... -->), this is a finding.

If there is no active (uncommented) <Connector> configured with SSLEnabled="true", scheme="https", and secure="true", this is a finding.

Configure ColdFusion to use HTTPS and disable unsecured HTTP access.

1. Locate the server.xml file for each ColdFusion instance located at: <ColdFusion_Installation_Directory>\cfusion\runtime\conf\

2. Open the server.xml file in a text editor.

3. Locate all <Connector> elements using the HTTP protocol (e.g., protocol="org.apache.coyote.http11.Http11Protocol" or Http11NioProtocol) without the attribute SSLEnabled="true"

4. Either delete these unsecured <Connector> tags or comment them out using XML syntax:

<!-- <Connector port="8500" protocol="org.apache.coyote.http11.Http11Protocol" ... /> -->

5. Locate a <Connector> tag that includes SSLEnabled="true" and is configured to support HTTPS communication.

6. If this tag is present but commented out, uncomment it by removing the <!-- and --> markers.

7. If a secure HTTPS connector does not exist, create a new <Connector> tag within the <Service> element of the server.xml file. It should include the following attributes:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" clientAuth="false" keystoreFile="/path/to/keystore" keystorePass="changeit"/>

8. Replace /path/to/keystore with the actual path to the keystore file.

9. Replace "changeit" with the actual password for the keystore.

10. Save the file and restart ColdFusion for the changes to take effect.