The ColdFusion administrator must be using HTTPS to maintain the confidentiality and integrity of information during reception.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-279098	SRG-APP-000442-AS-000259	APAS-CF-000910	SV-279098r1172830_rule	2025-12-19	1

Description
Information can be either unintentionally or maliciously disclosed or modified during reception, including, for example, during aggregation, at protocol transformation points and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. ColdFusion must use approved encryption when receiving transmitted data by configuring the Tomcat Connector to use HTTPS.

Description

Information can be either unintentionally or maliciously disclosed or modified during reception, including, for example, during aggregation, at protocol transformation points and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. ColdFusion must use approved encryption when receiving transmitted data by configuring the Tomcat Connector to use HTTPS.

ℹ️ Check
Verify HTTPS. 1. Locate the server.xml file for each ColdFusion instance located at: <ColdFusion_Installation_Directory>\cfusion\runtime\conf\ 2. Open the server.xml file in a text editor. 3. Locate all <Connector> elements configured with an HTTP protocol (e.g., protocol="org.apache.coyote.http11.Http11Protocol" or Http11NioProtocol). If any HTTP connector exists without SSLEnabled="true" and is not commented out (<!-- ... -->), this is a finding. If there is no active (uncommented) <Connector> configured with SSLEnabled="true", scheme="https", and secure="true", this is a finding.

ℹ️ Check

Verify HTTPS. 1. Locate the server.xml file for each ColdFusion instance located at: <ColdFusion_Installation_Directory>\cfusion\runtime\conf\ 2. Open the server.xml file in a text editor. 3. Locate all <Connector> elements configured with an HTTP protocol (e.g., protocol="org.apache.coyote.http11.Http11Protocol" or Http11NioProtocol). If any HTTP connector exists without SSLEnabled="true" and is not commented out (), this is a finding. If there is no active (uncommented) <Connector> configured with SSLEnabled="true", scheme="https", and secure="true", this is a finding.

✔️ Fix
Configure ColdFusion to use HTTPS and disable unsecured HTTP access. 1. Locate the server.xml file for each ColdFusion instance located at: <ColdFusion_Installation_Directory>\cfusion\runtime\conf\ 2. Open the server.xml file in a text editor. 3. Locate all <Connector> elements using the HTTP protocol (e.g., protocol="org.apache.coyote.http11.Http11Protocol" or Http11NioProtocol) without the attribute SSLEnabled="true" 4. Either delete these unsecured <Connector> tags or comment them out using XML syntax: <!-- <Connector port="8500" protocol="org.apache.coyote.http11.Http11Protocol" ... /> --> 5. Locate a <Connector> tag that includes SSLEnabled="true" and is configured to support HTTPS communication. 6. If this tag is present but commented out, uncomment it by removing the <!-- and --> markers. 7. If a secure HTTPS connector does not exist, create a new <Connector> tag within the <Service> element of the server.xml file. It should include the following attributes: <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" clientAuth="false" keystoreFile="/path/to/keystore" keystorePass="changeit"/> 8. Replace /path/to/keystore with the actual path to the keystore file. 9. Replace "changeit" with the actual password for the keystore. 10. Save the file and restart ColdFusion for the changes to take effect.

✔️ Fix

Configure ColdFusion to use HTTPS and disable unsecured HTTP access. 1. Locate the server.xml file for each ColdFusion instance located at: <ColdFusion_Installation_Directory>\cfusion\runtime\conf\ 2. Open the server.xml file in a text editor. 3. Locate all <Connector> elements using the HTTP protocol (e.g., protocol="org.apache.coyote.http11.Http11Protocol" or Http11NioProtocol) without the attribute SSLEnabled="true" 4. Either delete these unsecured <Connector> tags or comment them out using XML syntax:  5. Locate a <Connector> tag that includes SSLEnabled="true" and is configured to support HTTPS communication. 6. If this tag is present but commented out, uncomment it by removing the  markers. 7. If a secure HTTPS connector does not exist, create a new <Connector> tag within the <Service> element of the server.xml file. It should include the following attributes: <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" clientAuth="false" keystoreFile="/path/to/keystore" keystorePass="changeit"/> 8. Replace /path/to/keystore with the actual path to the keystore file. 9. Replace "changeit" with the actual password for the keystore. 10. Save the file and restart ColdFusion for the changes to take effect.