XJetty allow accessing any application file through URL

Hi,

It seems that the debian packages for XWiki with jetty "xwiki-xjetty-common, xwiki-xjetty-mariadb 16.10.10" have an insecure default configuration. 

"Various application or web servers / products are prone to an information disclosure vulnerability.

Detection Result

Vulnerable URL: https://xwiki.example.com/webapps/root/WEB-INF/web.xml

"

I know it is a local configuration issue on the system - the problem is I have used the default config of the package xwiki-jetty-common without any changes. I would expect the servlet container to prohibit this by default, as Tomcat does, for example.

And that is the very dangerous thing in my opinion...

 
MichaelHamann:
I confirm in the Jetty demo distribution I can also access the URLs /webapps/xwiki/WEB-INF/xwiki.properties and /webapps/xwiki/WEB-INF/hibernate.cfg.xml (which definitely shouldn't be possible).