> We just had a PCI Compliance scan done through SecurityMetrics > and have one issue:
Get in touch with your account rep and ask them to disable that specific test. It is mitigated by the fact that ColdFusion session IDs (which are sequential if you're using standard CF sessions) are only valid in the presence of a corresponding token ID which their scanner doesn't account for. Since there is a mitigating factor, they have always been able to disable that test on my scans without complaint. -Justin ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Want to reach the ColdFusion community with something they want? Let them know on the House of Fusion mailing lists Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:330769 Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4
