| Vuln ID | Severity | Asset | STIG | Title | Status | Doc Status | Assigned To | Actions |
|---|---|---|---|---|---|---|---|---|
| V-218798 | CAT II | SCHR-P3-DP-001 | Microsoft IIS 10.0 Server Security Techn... | The IIS 10.0 web server must have Multipurpose Int... | - | |||
Check TextNote: If the server is hosting WSUS, this is not applicable. Open the IIS 10.0 Manager. Click the IIS 10.0 web server name. Under IIS, double-click the "MIME Types" icon. From the "Group by:" drop-down list, select "Content Type". From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions: .exe .dll .com .bat .csh If any OS shell MIME types are configured, this is a finding. Fix TextOpen the IIS 10.0 Manager. Click the IIS 10.0 web server name. Under IIS, double-click the "MIME Types" icon. From the "Group by:" drop-down list, select "Content Type". From the list of extensions under "Application", remove MIME types for OS shell program extensions, to include at a minimum, the following extensions: .exe .dll .com .bat .csh Under the "Actions" pane, click "Apply". Finding DetailsEvaluate-STIG 1.2601.0 (Scan-IIS10_0_Server_Checks) found this to be OPEN on 03/05/2026 ResultHash: 47C2C311101A88836E6EF2E986BC87A38AC57B63 ~~~~~ The following invalid MIME types for OS shell program extensions are configured: .exe .dll .csh CommentsManual check shows settings as follows: No invalid MIME types for OS shell program extensions found.
Source: SCHR-P3-DP-001_IIS10Server_V3R6_20260305-132942.cklb
Scan Date: 2026-03-12T15:38:14.420977
Technology Area: Web Review
|
||||||||