STIGQter STIGQter: STIG Summary: Microsoft IIS 8.5 Server Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

The IIS 8.5 web server must not perform user management for hosted applications.

DISA Rule

SV-214407r508658_rule

Vulnerability Number

V-214407

Group Title

SRG-APP-000141-WSR-000015

Rule Version

IISW-SV-000117

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Reconfigure any hosted applications on the IIS 8.5 web server to perform user management outside the IIS 8.5 web server.

Document how the hosted application user management is accomplished.

Check Contents

Interview the System Administrator about the role of the IIS 8.5 web server.

If the IIS 8.5 web server is hosting an application, have the SA provide supporting documentation on how the application's user management is accomplished outside of the IIS 8.5 web server.

If the IIS 8.5 web server is not hosting an application, this is Not Applicable.

If the IIS web server is performing user management for hosted applications, this is a finding.

If the IIS 8.5 web server is hosting an application and the SA cannot provide supporting documentation on how the application's user management is accomplished outside of the IIS 8.5 web server, this is a finding.

Vulnerability Number

V-214407

Documentable

False

Rule Version

IISW-SV-000117

Severity Override Guidance

Interview the System Administrator about the role of the IIS 8.5 web server.

If the IIS 8.5 web server is hosting an application, have the SA provide supporting documentation on how the application's user management is accomplished outside of the IIS 8.5 web server.

If the IIS 8.5 web server is not hosting an application, this is Not Applicable.

If the IIS web server is performing user management for hosted applications, this is a finding.

If the IIS 8.5 web server is hosting an application and the SA cannot provide supporting documentation on how the application's user management is accomplished outside of the IIS 8.5 web server, this is a finding.

Check Content Reference

M

Target Key

4000

Comments