Exception Report Disclosure (Tomcat)

Summary#

Invicti identified an exception report disclosure (Tomcat) in the target web server's HTTP response.

Impact#

An attacker can obtain information such as:

This information might help an attacker gain more information and potentially focus on the development of further attacks to the target system.

Remediation#

Apply the following configuration to your web.xml file to prevent information leakage by applying custom error pages.

<error-page>
    <error-code>500</error-code>
    <location>/server_error.html</location>
</error-page>

Classifications#