10045-2—Properties File Disclosure - /WEB-INF folder

PUBLISHEDsecurity alertHigh

Active

Metadata

Alert ID:: 10045-2
Risk:: High
Type:: Active
CWE:: CWE-541Inclusion of Sensitive Information in an Include File

摘要

A Java class in the /WEB-INF folder disclosed the presence of the properties file. Properties file are not intended to be publicly accessible, and typically contain configuration information, application credentials, or cryptographic keys.

解决方案

The web server should be configured to not serve the /WEB-INF folder or its contents to web browsers. It may also be possible to remove the /WEB-INF folder.

其他信息

The reference to the properties file was found in the dis-assembled Java source code for Java class [https://example.com/foo.class].

参考

browse all alerts