ColdFusion Server Security Report [example.com]
|Server Local IP:
|Probe API Version:
||11.0.7 Oracle Corporation running as root
ColdFusion 2021 Update 5 / Security Hotfix (Oct 11, 2022) Not Installed
ColdFusion 2021 Update 4 / Security Hotfix (May 10, 2022) Not Installed
ColdFusion 2021 Update 3 / Security Hotfix (Dec 17, 2021) Not Installed
ColdFusion 2021 Update 2 / Security Hotfix (Sep 14, 2021) Not Installed
ColdFusion 2021 Update 1 / Security Hotfix (Mar 22, 2021) Installed
Please note, Cumulative Hotfixes focus on bug fixes and may or may not include security hotfixes, they are not required and Adobe may only recommend installing them if you are experiencing one of the issues resolved (please read the linked KB article).
Make sure you have checked your server for log4j jar files that might have been included in third party libraries. More Info
TLS / SSL Report
We found 20 security issues on your server example.com
SSL Version 2 Enabled
Your Web Server is accepting SSL V2 connections, a weak protocol. For PCI compliance, and strong security you must disable this protocol on your web server.
Robust Exception Information is Enabled
Robust Exception Information is enabled which leads to path disclosure and partial source code disclosure. This can also be triggered if you have a custom error handler that is disclosing too much information.
Log4Shell Security Hotfix CF2021u3 / CF2018u13
The ColdFusion Log4Shell / log4j Security Hotfix was not found to be installed on your server. This hotfix resolves a critical remote code execution vulnerability (CVE-2021-44228) and another important issue CVE-2021-45046. These issues are resolved by installing ColdFusion 2021 Update 3 or later or ColdFusion 2018 Update 13 or later. For CF2018 make sure you have applied the post installation AJP connector configuration step mentioned in CF2018 Update 8.
Security Hotfix APSB21-75 Not Installed
The security hotfix referenced in Adobe Security Bulletin APSB21-75 was not found to be installed on your server. This hotfix resolves two critical security feature bypasses (CVE-2021-40698 and CVE-2021-40699). This issue is resolved in ColdFusion 2021 Update 2 or later, ColdFusion 2018 Update 12 or later. For CF2018 make sure you have applied the post installation AJP connector configuration step mentioned in CF2018 Update 8.
Security Hotfix APSB22-44 Not Installed
The security hotfix referenced in Adobe Security Bulletin APSB22-44 was not found to be installed on your server. This hotfix addresses 6 critical, 6 important, and one Moderate severity level issues. These issues are resolved in ColdFusion 2021 Update 5 or later, ColdFusion 2018 Update 15 or later. For CF2018 make sure you have applied the post installation AJP connector configuration step mentioned in CF2018 Update 8.
ColdFusion Administrator is Public
ColdFusion Administrator should be restricted by IP or blocked with Web Server password protection. Also consider requiring a SSL connection.
CFTOKEN is not a UUID
CFTOKEN should be set to use a UUID in the ColdFusion Administrator. Session ids may be very easy to guess if UUID's are not used.
RDS may be Enabled
RDS may be enabled on your server (due to a change in recent CF versions we can no longer detect if it is on or off, however we have detected that the RDSServlet URI is responding to requests). We recommened that you block the URI /CFIDE/main/ide.cfm and/or remove the Servlet Mapping in web.xml to prevent unnecessary access to the RDSServlet.
Certificate Signature Uses SHA1
Your SSL Certificate is signed using a SHA1 signature, which is considered weak. You may see security errors or warnings in Chrome.
SSL Version 3 Enabled
Your Web Server is accepting SSL V3 connections, vulnerabile to the POODLE (CVE-2014-3566) attack. Consider disabling this protocol, which may impact old clients such as IE6 on Windows XP. Disabling SSLv3 may also impact server side HTTPS clients (that consume your web services or APIs), and potentially bots / crawlers. You can use our IIS SSL tool to disable SSLv3 on IIS: https://foundeo.com/products/iis-weak-ssl-ciphers/
The JVM is Running under Privileged User Account
The JVM process is running under a system administrative account (eg SYSTEM, Administrator, or root). ColdFusion should be running under an un-privileged user account.
Tomcat 9 Vulnerability
The version of Tomcat 9 you are running contains security vulnerabilities that are fixed in Tomcat Version 9.0.65 or greater. Adobe ColdFusion 2018/2021 users: Apply Update 2018u14/2021u4 to update Tomcat to version 9.0.60, expect Adobe to include 9.0.65 or greater in a future update. Lucee users should update Tomcat manually.
The /cf_scripts/scripts directory is in default location.
Consider changing the default location of /cf_scripts/scripts/ or /cfscripts_2018/ by changing the value of the Default Script Src setting in the ColdFusion Administrator.
Java 11 Security Update Available
The JVM that you are running contains security vulnerabilities that could be exploited in server side environments. Update to the latest version of Java 11. Note that Oracle Java 11 requires a commercial license. Adobe CF customers can download Oracle Java 11 from the ColdFusion Downloads Page. You can also use OpenJDK, Amazon Corretto, or other non-oracle JVMs for free.
Security Hotfix APSB22-22 Not Installed
The security hotfix referenced in Adobe Security Bulletin APSB22-22 was not found to be installed on your server. This hotfix resolves an important issue: CVE-2022-28818. This issue is resolved in ColdFusion 2021 Update 4 or later, ColdFusion 2018 Update 14 or later. For CF2018 make sure you have applied the post installation AJP connector configuration step mentioned in CF2018 Update 8.
Session Cookies are not marked HTTPOnly
LogJam: DH Group Uses a common prime.
Your HTTPS server is configured to use a common 1024bit prime. Security researchers estimate that a nation-state could break encryption on servers with a common 1024 bit DH group prime.
LogJam: DH Group Smaller than 2048 Supported
Your server supports a DH Group Size smaller than 2048 bits. It is recommended to use a unique 2048-bit Diffie-Hellman group. Note that Java 1.7 and below cannot connect to servers (eg with CFHTTP) using a DH group size larger than 1024.
SSL Certificate Public Key Below 2048 Bits
Your SSL certificate public key is below 2048 bits, consider making a new certificate signing request (CSR) and rekey your certificate with 2048 bit key or larger.
SSL Certificate Expires Soon
Your SSL certificate will expire soon, please make sure you renew it.
Please note, this tool is not able to test for all potential security issues that may exist.
Dig Deeper & Stay Updated with Our Paid Service
When you Signup for our service you can:
- Finds more security issues such as JVM vulnerabilities, missing ColdFusion hotfixes, etc (using our probe)
- Receive Automated Daily, Weekly, Monthly, or Quarterly server vulnerability reports
- Keep track of multiple servers at once
- Keep track of which hotfixes were installed and when.
- Get notified when new security hotfixes are released.
- PDF Reports
- Scan as much as you want, and view results instantly.
Pricing starts at $10/month
Found 5 Critical Issues
These issues pose a significant security risk. It is imperative that they are resolved at once.
Found 10 Important Issues
These issues may have a security risk in certain conditions. It is recommended that you resolve them.
Found 5 Warnings
You should consider fixing these issues, however, they do not pose a large risk.