ServletExec 4.1 ISAPI Physical Path Disclosure

  1. Network Vulnerabilities
  2. Web application abuses
  3. ServletExec 4.1 ISAPI Physical Path Disclosure
Summary
By requesting a non-existent .JSP file, or by invoking the JSPServlet directly and supplying no filename, it is possible to make the ServletExec ISAPI filter disclose the physical path of the webroot.
Solution
Use the main ServletExec Admin UI to set a global error page for the entire ServletExec Virtual Server.
Severity
Medium Severity
Classification
Related Vulnerabilities