IT22225: SERVER SIDE VARIABLE NAME LEAKAGE

iSeries_Media_5020601_10
Media_IM_5020601_10
Media_IM_5020601_10
Media_IM_5020601_10

APAR status

• Closed as program error.

Error description

• The affected application discloses an internal, server-side
  variable as part of the internet accessible files. While trying
  to access the non-existent URI based on myfilegateway, leads to
  HTTP 404 page error and the internal variable name
  WEBAPP_CONTEXT_NAME is revealed.
  

Local fix

• None
  
  KK/KK
  STRRTC 540666
  

Problem summary

• Users Affected:
  All
  
  Problem Description:
  When you access the non-existent URI based on myfilegateway, it
  leads to HTTP 404 page error and the internal variable name
  WEBAPP_CONTEXT_NAME is revealed.
  
  If you access page
  http://<URL:PORT>/myfilegateway/test/logon.html,
  it is redirected to
  http://<URL:PORT/${WEBAPP_CONTEXT_NAME}/in
  dex.jsp , which means WEBAPP_CONTEXT_NAME variable is leaked.
  
  Platforms Affected:
  All
  

Problem conclusion

• Resolution Summary:
  A code fix is provided.
  
  Delivered In:
  5020601_10
  5020602_6
  5020603_6
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  STR B2B INTEGRA

• Fixed component ID

  5725D0600

Applicable component levels