iDefense Security Advisory 06.03.08 – Remote exploitation of an information disclosure vulnerability in Sun Microsystem’s Java System Active Server Pages allows attackers to obtain sensitive information. This vulnerability exists due to the placement of the password and configuration data within the application server root directory. By making requests for specific, sensitive documents an attacker could obtain the configuration or password hashes of allowed users. iDefense has confirmed the existence of this vulnerability within version 4.0.2 of Sun Microsystems Inc.’s Java System Active Server Pages. Older versions are suspected to be vulnerable.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/66972/06.03.08-2.txt
Source: https://packetstormsecurity.com/files/66972/iDEFENSE-Security-Advisory-2008-06-03.2.html