I want to remove (or just disable) one of the apps on the build in tomcat 9 web server (called webcart).
Should I be enabling tomcat manager to do this, is is there a better way?
Confluence generally is not run with other applications in Tomcat - in theory, it can, but the standard installers won't set up Tomcat with anything that enables it, you have to do quite a bit of work to get it to work (ok, unless you're on a very old, unsupported version of Confluence based on the WAR/EAR distribution)
So the answer to this question becomes "how are you enabling these apps?"
Hi Nic,
Many thanks for your response.As far as I'm aware no-one is enabling any additional apps on the Tomcat web server. We're running a vanilla VM with Windows 2016 datacenter which is hosting our install of Confluence (in a default self hosted install) and that's it.
We use the Nessus vulnerability scanner on all the web servers and it's flagging that a "webcart" app is installed with publicly visible folders on this web server but I can't find where this app or folders are, this is why I wanted to have a look in Tomcat manager to try and find it.
FYI, this is the error - https://www.tenable.com/plugins/nessus/10298
Daniel
That would be quite interesting - the webcart thing is not part of Confluence and not installed with it, so either Nessus is mis-reporting, or someone has added it to your Tomcat for some reason (and then hidden it somehow by renaming things!)
My instinct is that Nessus is probably firing a false positive.
Ok I have an update on the cause, after spending a bit of time looking into this,
I looks like confluence is responding with a 200 OK for URL's that shouldn't exist, which Nessus is taking as an assumption that webcart is installed.
So there is definitely nothing installed on the web server that shouldn't be there, but in order to prevent this false positive I need to make the web server not respond with a 404 for non-existent pages if that makes sense.
As an example, if I go to https://myconfluencesite.com/somerandomtext it should show a 404 but it's directing to https://myconfluencesite.com/#all-updates which is a real page
It looks like you're new here. Sign in or register to get started.
