You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2008/05/21 18:33:45 UTC
DO NOT REPLY [Bug 45059] New:
http://www.servername.com/WEB-INF./web.xml
https://issues.apache.org/bugzilla/show_bug.cgi?id=45059
Summary: http://www.servername.com/WEB-INF./web.xml
Product: Tomcat 5
Version: Unknown
Platform: PC
OS/Version: Windows XP
Status: NEW
Severity: normal
Priority: P2
Component: Unknown
AssignedTo: tomcat-dev@jakarta.apache.org
ReportedBy: varadasrini@gmail.com
We are working over a problem in the embedded tomcat server which leading us to
security compliance.
The Resources defined in the deployment descriptor are been display in the
following
http://www.servername.com/WEB-INF./web.xml
We tried to block the this request, but we are not able to restrict the request
to display the xml content of web.xml.
I hope someone might have seen similar vunerability to the web server. Please
advice on this issues. we are using Apache Tomcat 5.5.9 & 5.5.20 also.
We have tried on the context setting and other settings of the server.
Thanks in Advance,
Srinivas
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 45059] http://www.servername.com/WEB-INF./web.xml
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45059
Tim Funk <fu...@joedog.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |INVALID
--- Comment #1 from Tim Funk <fu...@joedog.org> 2008-05-21 10:00:24 PST ---
This is a configuration issue.
Please use the tomcat-user list to debug the issue.
Odds are one of the following:
- Case sensitivity is turned off
- Apache httpd's jk directives are not setup correctly.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org