Directory Browsing on the IIS 10.0 web server must be disabled.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-218808 | SRG-APP-000251-WSR-000157 | IIST-SV-000138 | SV-218808r961158_rule | 2025-02-11 | 3 |
| Description |
|---|
| Directory browsing allows the contents of a directory to be displayed upon request from a web client. If directory browsing is enabled for a directory in IIS, users could receive a web page listing the contents of the directory. If directory browsing is enabled, the risk of inadvertently disclosing sensitive content is increased. |
| ℹ️ Check |
|---|
| Open the IIS 10.0 Manager. Click the IIS 10.0 web server name. Double-click the "Directory Browsing" icon. Under the “Actions” pane verify "Directory Browsing" is disabled. If “Directory Browsing” is not disabled, this is a finding. |
| ✔️ Fix |
|---|
| Open the IIS 10.0 Manager. Click the IIS 10.0 web server name. Double-click the "Directory Browsing" icon. Under the "Actions" pane click "Disabled". Under the "Actions" pane, click "Apply". |