Apache Tomcat source.jsp malformed request information disclosure

  1. Network Vulnerabilities
  2. Web application abuses
  3. Apache Tomcat source.jsp malformed request information disclosure
Summary
The source.jsp file, distributed with Apache Tomcat server, will disclose information when passed a malformed request. As a result, information such as the web root path and directory listings could be obtained. Example: http://target/examples/jsp/source.jsp?? - reveals the web root http://target/examples/jsp/source.jsp?/jsp/ - reveals the contents of the jsp directory
Solution
Remove default files from the web server
References
Updated on 2015-03-25
Severity
Medium Severity
Classification
Related Vulnerabilities