I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config.
I don't how to restrict. I tried with file permissions, but when I remove read permissions the whole application stops working.
I googled and found that security constraints on servlet mapping can be used, but the developer says that is for weblogic. The java sys application is deployed on win 2008.
Are there other solutions?