ColdFusion must not allow application variables to be added to Servlet Context.

From Adobe ColdFusion 11 Security Technical Implementation Guide

Associated with: CCI-001082

SV-76959r1_rule ColdFusion must not allow application variables to be added to Servlet Context.

Vulnerability discussion

ColdFusion allows applications to add application variables to the Servlet Context. This allows an application to add data or change configuration data for all hosted applications. By sharing data across applications, the applications are no longer isolated with one application affecting other applications. By disabling this capability, the hosted applications, including the Administrator Console, are isolated.

Check content

Within the Administrator Console, navigate to the "Settings" page under the "Server Settings" menu. If "Allow adding application variables to Servlet Context" is checked, this is a finding.

Fix text

Navigate to the "Settings" page under the "Server Settings" menu. Uncheck "Allow adding application variables to Servlet Context" and select the "Submit Changes" button.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.