You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2008/05/21 18:33:45 UTC

DO NOT REPLY [Bug 45059] New: http://www.servername.com/WEB-INF./web.xml

https://issues.apache.org/bugzilla/show_bug.cgi?id=45059

           Summary: http://www.servername.com/WEB-INF./web.xml
           Product: Tomcat 5
           Version: Unknown
          Platform: PC
        OS/Version: Windows XP
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Unknown
        AssignedTo: tomcat-dev@jakarta.apache.org
        ReportedBy: varadasrini@gmail.com


We are working over a problem in the embedded tomcat server which leading us to
security compliance.

The Resources defined in the deployment descriptor are been display in the
following

http://www.servername.com/WEB-INF./web.xml


We tried to block the this request, but we are not able to restrict the request
to display the xml content of web.xml.

I hope someone might have seen similar vunerability to the web server. Please
advice on this issues. we are using Apache Tomcat 5.5.9 & 5.5.20 also.

We have tried on the context setting and other settings of the server.

Thanks in Advance,
Srinivas


-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org

DO NOT REPLY [Bug 45059] http://www.servername.com/WEB-INF./web.xml

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45059


Tim Funk <fu...@joedog.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |INVALID




--- Comment #1 from Tim Funk <fu...@joedog.org>  2008-05-21 10:00:24 PST ---
This is a configuration issue.

Please use the tomcat-user list to debug the issue.

Odds are one of the following:
- Case sensitivity is turned off
- Apache httpd's jk directives are not setup correctly.


-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org