ColdFusion must transmit only encrypted representations of passwords for Flex Integration.

From Adobe ColdFusion 11 Security Technical Implementation Guide

Associated with: CCI-000197

SV-76945r1_rule ColdFusion must transmit only encrypted representations of passwords for Flex Integration.

Vulnerability discussion

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised.ColdFusion offers RMI communication between Flex and ColdFusion. The communication between the two will require authentication data. When authentication data is transmitted, the data must be encrypted to protect it from discovery. This can be done by enabling RMI over SSL within the Administrator Console.

Check content

Within the Administrator Console, navigate to the "Flex Integration" page under the "Data & Services" menu. Ask the administrator if Flex is being used and if user credentials are being used for authentication. If user credentials are being used for Flex authentication to ColdFusion and "Enable RMI over SSL for Data Management" is not checked, this is a finding.

Fix text

Navigate to the "Flex Integration" page under the "Data & Services" menu. Check "Enable RMI over SSL for Data Management" and select the "Submit Changes" button.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.