Tomcat Version Disclosure

Description

Exposing detailed information such as the Tomcat version number facilitates attackers in identifying vulnerabilities and planning their attacks more effectively.

Recommendation

To mitigate this issue:

• Open the server.xml file.
• Find the Host section and add the following line immediately after it: <Valve className="org.apache.catalina.valves.ErrorReportValve" showReport="false" showServerInfo="false" />
• Save the file and restart the application.

References

• Apache Tomcat
• Apache Tomcat Documentation: ErrorReportValve
• CWE-16
• CWE-200
• OWASP 2021-A5
• OWASP: Fingerprint Web Server

Related Issues

• Apache Version Disclosure - Vulnerability
• Nginx Version Disclosure - Vulnerability
• Server Version Disclosure - Vulnerability
• ASP.NET Version Disclosure - Vulnerability

Tags:

Information Disclosure

Server Misconfiguration

Tomcat

Web Server

WASC-13

WASC-14

CWE-200

CWE-16

OWASP 2021-A5

OWASP 2017-A6

OWASP 2013-A5

CAPEC-118