Re: Vulnerability flagged in Nessus Scan

2020-06-08 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Fang, Your application's web.xml will only provide error messages for errors which occur when a request has been issued to your application (e.g. /myapp/doesnotexist -> 404 -> your 404 page). But if you request something outside your web application

Re: Vulnerability flagged in Nessus Scan

2020-06-07 Thread FANG YAP
Hello Martin and John, Any update on this? Regards with Thanks, Fang On Thu, 4 Jun 2020, 09:48 FANG YAP, wrote: > Hi Martin, > > Thank you for your email. > > In my application's web.xml, there is already a default > error-code that defines 404 (../error_404.jsp), 403 (../error_403.jsp), 500

Re: Vulnerability flagged in Nessus Scan

2020-06-03 Thread FANG YAP
Hi Martin, Thank you for your email. In my application's web.xml, there is already a default error-code that defines 404 (../error_404.jsp), 403 (../error_403.jsp), 500 (../error_500.jsp) and java.lang.Throwable (.. /system Error.jsp) where as the tomcat web.xml defines the previous error page

Re: Vulnerability flagged in Nessus Scan

2020-06-03 Thread John Palmer
As the concern is that an erro page will show the tomcat version/patch info AND a stacktrace,\ I found the easier/better? solution to be adding . showReport="false" showServerInfo="false" to the Error Report Valve section at the bottom of server.xml (and addin or or uncommenting that valve sect

Re: Vulnerability flagged in Nessus Scan

2020-06-03 Thread Martin Grigorov
On Wed, Jun 3, 2020 at 11:14 AM FANG YAP wrote: > Hello Martin, > > It is to say that I have to declare something like this in web.xml file? > > > java.lang.Exception > /error.jsp > Better use the error-code ones from the StackOverflow link I gave you. Your approach will cover only error code 5

Re: Vulnerability flagged in Nessus Scan

2020-06-03 Thread FANG YAP
Hello Martin, It is to say that I have to declare something like this in web.xml file? java.lang.Exception /error.jsp Regards with Thanks, Fang On Wed, 3 Jun 2020, 15:56 Martin Grigorov, wrote: > Hi, > > On Wed, Jun 3, 2020 at 5:53 AM FANG YAP wrote: > > > Resend > > > > On Wed, 3 Jun 2020

Re: Vulnerability flagged in Nessus Scan

2020-06-03 Thread Martin Grigorov
Hi, On Wed, Jun 3, 2020 at 5:53 AM FANG YAP wrote: > Resend > > On Wed, 3 Jun 2020, 10:10 FANG YAP, wrote: > > > Hi Tomcat, > > > > Nessus scanned and found issue in Apache Tomcat Port 8080 > > > > Port: 8080 > > Plugin Text: > > The server is not configured to return a custom page in the event

Re: Vulnerability flagged in Nessus Scan

2020-06-02 Thread FANG YAP
Resend On Wed, 3 Jun 2020, 10:10 FANG YAP, wrote: > Hi Tomcat, > > Nessus scanned and found issue in Apache Tomcat Port 8080 > > Port: 8080 > Plugin Text: > The server is not configured to return a custom page in the event of a > client requesting a non-existent resource. This may result in a po