UCF STIG Viewer Logo

Cross-Site Scripting (XSS) Filter property must be enforced (Restricted Site zone).


Overview

Finding ID Version Rule ID IA Controls Severity
V-22161 DTBI890 SV-40740r1_rule ECSC-1 Medium
Description
The Cross-Site Scripting (XSS) Filter is designed to prevent users from becoming victims of unintentional information disclosure. This setting controls if the Cross-Site Scripting (XSS) Filter detects and prevents cross-site script injection into web sites in this zone. If you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections. If you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections.
STIG Date
Microsoft Internet Explorer 9 Security Technical Implementation Guide 2015-12-17

Details

Check Text ( C-39487r1_chk )
The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> “Turn on Cross-Site Scripting (XSS) Filter” must be “Enabled” and “Enable” selected from the drop-down box.

Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4

Criteria: If the value 1409 is REG_DWORD = 0, this is not a finding.
Fix Text (F-34604r1_fix)
Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> “Turn on Cross-Site Scripting (XSS) Filter” to “Enabled” and select “Enable” from the drop-down box.