It is possible to construct a web request which is capable of accessing the contents of password protected files/folders.
vulners.com/securityvulns/securityvulns:doc:3682
vulners.com/securityvulns/securityvulns:doc:3761