users@glassfish.java.net

Re: WEB-INF dot file retrieval vulnerability on Win32 boxes

From: <glassfish_at_javadesktop.org>
Date: Mon, 11 Aug 2008 15:54:55 PDT

I have GlassFish V2 UR 2 installed on Windows Vista.

I have an app deployed and I tried to expose the content of the web.xml, using your suggested strategy.

I was not able to replicate your results.

I then added a property to the sun-web.xml (as documented in http://docs.sun.com/app/docs/doc/820-4497/create-virtual-server-1?a=view) and redeployed it.

Once I did that, I was able to replicate your result.

vbk
[Message sent by forum member 'vbkraemer' (vbkraemer)]

http://forums.java.net/jive/thread.jspa?messageID=292716