• Global community
    • Language:
      • Deutsch
      • English
      • Español
      • Français
      • Português
  • 日本語コミュニティ
    Dedicated community for Japanese speakers
  • 한국 커뮤니티
    Dedicated community for Korean speakers
Exit
0

ColdFusion web.xml exposed

New Here ,
Dec 02, 2015 Dec 02, 2015

Copy link to clipboard

Copied

How can I prevent someone from downloading the web.xml file using a Nessus exploit. I do have access to the ColdFusion administrator and enabled several security settings but WEB-INF/web.xml can still be accessed.I have spent the last 2 hours trying to find the solution online.

Sorry if that is an obvious setting but I don't know much about ColdFusion as I am a IBM Notes administrator...

Views

354

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
LEGEND ,
Dec 03, 2015 Dec 03, 2015

Copy link to clipboard

Copied

LATEST

Don't use the default CF installation settings for hosting.  It will default to {drive}/ColdfusionX/cfusion/wwwroot, and place the CFIDE folder and WEB-INF folder, there.  Whatever webserver you're using (Apache, IIS), set it (and CF server) to a different location, and map the CFIDE and WEB-INF directories in CFAdmin.

A good idea would be to follow a Lockdown Guide, when setting up your CF server.  Charlie Arehart has a list of preferred guides.

HTH,

^_^

Votes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Resources
Documentation