This morning i received from the auditors a scanner result for our jboss server and we need to solve three important issues, but honestly i was googling for a while and nothing found. if any one know or have any clue how to solve, i will appreciate. We are running jboss 5.0.1 on (windows 2003 x64)
.- JBoss HttpAdaptor JMXInvokerServlet is Accessible to Unauthenticated Remote Users .- JBoss EJBInvokerServlet is Accessible to Unauthenticated Remote Users. .- TLS Protocol Session Renegotiation Security Vulnerability
Thanks in advance.
If you’ve left your configuration as is, the above is available you have a problem.
The reason you don’t want to do it is pretty clear, it allows anyone to invoke any servlet they want that is on your system.
The short answer is, find it in your web.xml and disable it.
A Tomcat Specific article about the why: