WEB_IIS .htr access

 

Code: p1133

Severity: Warning

 

Description: This event is generated when an attempt is made to disclose the contents of an Active Server Page (ASP) using a malformed HTR request.

Impact: Information gathering. Fragments of the source code of an ASP may be returned possibly disclosing sensitive information.

Corrective: Apply the patch referenced in the Microsoft link. Consider running the IIS Lockdown Tool to disable HTR functionality.