| Vuln ID | Severity | Asset | STIG | Title | Status | Doc Status | Assigned To | Actions |
|---|---|---|---|---|---|---|---|---|
| V-218769 | CAT II | SCHR-P3-DP-001 | Microsoft IIS 10.0 Site Security Technic... | IIS 10.0 website session IDs must be sent to the c... | - | |||
Check TextFollow the procedures below for each site hosted on the IIS 10.0 web server: Access the IIS 10.0 Manager. Select the website being reviewed. Under "Management" section, double-click the "Configuration Editor" icon. From the "Section:" drop-down list, select "system.webServer/asp". Expand the "session" section. Verify the "keepSessionIdSecure" is set to "True". If the "keepSessionIdSecure" is not set to "True", this is a finding. Fix TextFollow the procedures below for each site hosted on the IIS 10.0 web server: Access the IIS 10.0 Manager. Select the website being reviewed. Under "Management" section, double-click the "Configuration Editor" icon. From the "Section:" drop-down list, select "system.webServer/asp". Expand the "session" section. Select "True" for the "keepSessionIdSecure" setting. Select "Apply" from the "Actions" pane. Finding DetailsEvaluate-STIG 1.2601.0 (Scan-IIS10_0_Site_Checks) found this to be NOT A FINDING on 03/05/2026 Site: Default Web Site ResultHash: 88428619BE4167554B71D4EBAEE30C7BD51B4A99 ~~~~~ KeepSessionIdSecure is set to 'True'
Source: SCHR-P3-DP-001_IIS10Site_Default_Web_Site_V2R14_20260305-133115.cklb
Scan Date: 2026-03-12T15:38:14.459023
Technology Area: Web Review
|
||||||||