UCF STIG Viewer Logo

ColdFusion must disable creation of unnamed applications.


Overview

Finding ID Version Rule ID IA Controls Severity
V-62467 CF11-05-000163 SV-76957r1_rule Medium
Description
ColdFusion allows applications to be named or unnamed. The application name allows the developer to scope the application or define a logical application and allows for the separation of applications. When an application is unnamed, the application scope corresponds to the ColdFusion JEE servlet context. This also means that the application session corresponds directly to the session object of the JEE application server. Having unnamed applications is only necessary when the ColdFusion pages must share application or session scope data with existing JSP pages and servlets. Disabling the ability for unnamed applications allows the Administrator Console and all the other hosted applications to be isolated from each other.
STIG Date
Adobe ColdFusion 11 Security Technical Implementation Guide 2017-12-31

Details

Check Text ( C-63271r1_chk )
Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu.

If "Disable creation of unnamed applications" is unchecked, this is a finding.
Fix Text (F-68387r1_fix)
Navigate to the "Settings" page under the "Server Settings" menu. Check "Disable creation of unnamed applications" and select the "Submit Changes" button.