UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

ColdFusion must have the Default ScriptSrc Directory set to a non-default value.


Overview

Finding ID Version Rule ID IA Controls Severity
V-62443 CF11-03-000116 SV-76933r1_rule Medium
Description
The scripts directory contains common javascript code that may be used by the hosted applications. This code is offered to help the developer with common data controls and functions aiding in the quick development of applications. Unfortunately, this code has also been known to have security vulnerabilities. Because of this, many of the ColdFusion hacking tools look for this directory in the default location searching for files with known vulnerabilities. By moving the directory to a non-default location, the hacking tools are unable to find the directory making it more difficult for the attacker.
STIG Date
Adobe ColdFusion 11 Security Technical Implementation Guide 2017-06-15

Details

Check Text ( C-63247r1_chk )
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu.

If the "Default ScriptSrc Directory" is set to /CFIDE/scripts/", this is a finding.
Fix Text (F-68363r1_fix)
Navigate to the "Settings" page under the "Server Settings" menu. Enter the new location for the ScriptSrc Directory.