Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability(情報元のブックマーク数)

Tomcatに情報が見えてしまう脆弱性が存在するそうです。

Apache Tomcat is prone to a remote information-disclosure vulnerability.

Remote attackers can exploit this issue to obtain the contents of sensitive files stored on the server. Information obtained may lead to further attacks.

The following versions are affected:

Apache Tomcat 3.x, 4.0.x, and 5.0.x may also be affected.

http://www.securityfocus.com/bid/30494/discuss

Exploitが出ていますが、page.jspってのがあぶないみたい。

http://www.example.com/page.jsp?blah=/../WEB-INF/web.xml

screenshot