V-218779
CAT IIInteractive scripts on the IIS 10.0 web server must be located in unique and designated folders.
- Ships Affected
- 2
- Total Findings
- 4
- Open
- 0
- Closed
- 0
Check Text
Determine whether scripts are used on the web server for the target website. Common file extensions include, but are not limited to: .cgi, .pl, .vbs, .class, .c, .php, and .asp.
All interactive programs must be placed in unique designated folders based on CGI or ASP script type. For modular and/or third-party applications, it is permissible to have script files in multiple folders.
Open the IIS 10.0 Manager.
Right-click the IIS 10.0 web site name and select "Explore".
Search for the listed script extensions. Each script type must be in its unique designated folder.
If scripts are not segregated from web content and in their own unique folders, this is a finding.
If the website does not utilize CGI, this finding is Not Applicable.
Fix Text
All interactive programs must be placed in unique designated folders based on CGI or ASP script type.
Open the IIS 10.0 Manager.
Right-click the IIS 10.0 web server name and select "Explore".
Search for the listed script extensions.
Move each script type to its unique designated folder.
Set the permissions to the scripts folders as follows:
Administrators: FULL
TrustedInstaller: FULL
SYSTEM: FULL
ApplicationPoolId:READ
Custom Service Account: READ
Users: READ
ALL APPLICATION PACKAGES: READ
STIG Reference
- STIG
- Microsoft IIS 10.0 Site Security Technical Implementation Guide
- Version
- 2
- Release
- 15
- Rule ID
- SV-218779r1022698_rule
All Occurrences
This vulnerability appears on 2 ship(s)
| Ship | Hull # | Source File | Status | Assigned To | Scan Date | Actions |
|---|---|---|---|---|---|---|
| LAB BASELINES | BASELINE | SCHR-P3-DP-001_IIS10Site_Default_Web_Site_V2R14_20260305-133115.cklb | Unassigned | 2026-03-12T15:38:14.459023 | View in Context | |
| USNS MONTFORD POINT | T-ESD-1 | _Reviewed/MONT-DP-001/Checklist/MONT-DP-001_IIS10Site_Default_Web_Site_V2R12_20251023-143912.ckl | Unassigned | 2026-01-14T12:57:35.375369 | View in Context | |
| USNS MONTFORD POINT | T-ESD-1 | _Reviewed/MONT-MB-002/Checklist/MONT-MB-002_IIS10Site_Exchange_Back_End_V2R12_20251023-152602.ckl | Unassigned | 2026-01-14T12:57:33.300070 | View in Context | |
| USNS MONTFORD POINT | T-ESD-1 | _Reviewed/MONT-MB-002/Checklist/MONT-MB-002_IIS10Site_Default_Web_Site_V2R12_20251023-152518.ckl | Unassigned | 2026-01-14T12:57:33.098574 | View in Context |