[WW-4601] webconsole can always be accessed

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.3.31, 2.5.5
• Assignee: Lukasz Lenart
• Reporter: Alireza Fattahi
• Created: 31/Jan/16 11:04
• Updated: 13/Feb/17 09:52
• Resolved: 08/Jul/16 04:45

Description

It is possible that you get the webconsole.html in dev without having debug in the stack trace

I found that you can access /stuts/webconsole.html to see this html. For example (thanks jgeppert! ) :

http://struts.jgeppert.com/struts2-jquery-showcase/struts/webconsole.html

I wonder if this should be fixed and if this can be used for attackers.