Tomcat default files scan warning

Products

• CA Automic Workload Automation - Automation Engine

Issue/Introduction

Scan results show 

The server is not configured to return a custom page in the event of a client requesting a non-existent resource. This may result in a potential disclosure of sensitive information about the server to attackers.

And indicate the issue is with the following default files:

https://server.com:8080/docs/
https://server.com:8080/examples/servlets/index.html
https://server.com:8080/examples/jsp/index.html
https://server.com:8080/examples/websocket/index.xhtml

Environment

Automic Automation 21.0.x

Apache Tomcat for AWI

Cause

Tomcat includes default index.html, docs, examples, and JSPs which trigger this vulnerability output in scans. 

Resolution

The scan recommended solution is:
 
Delete the default index page and remove the example JSP and servlets. Follow the Tomcat or OWASP instructions to replace or modify the default error page.

======

Broadcom Support cannot advise or assist as Tomcat hardening is outside product support services and must be managed as part of the server environment.

Automic does not any use of the predefined Tomcat webapps, example JSP and servlets:

$TOMCAT_HOME\webapps
$TOMCAT_HOME\webapps\examples

Additional Information

The solution suggested by the scan is clear and simple and should be done by someone familiar with Tomcat.
Performing the delete will not affect Automic Automation or AWI as Automic does not use the default index/error pages, docs, or examples/JSPs from Tomcat.
Please reach out to someone within your organization who is familiar with Tomcat, possibly server or network teams. If there is not anyone familiar with Tomcat, please reach out to your account team who can assist in a services or partner engagement.