漏洞描述: Web服务器默认情况下开放了一些不必要的http方法，如DELETE、PUT、TRACE、MOVE等，很可能会在Web服务器上上传、修改或者删除Web页面、脚本和文件。使系统容易受到攻击。

解决方案: 禁用不必要的HTTP方法,修改应用程序的Web.xml，在文件中添加如下代码:

<security-constraint>
	<web-resource-collection>
		<url-pattern>/*</url-pattern>
		<http-method>PUT</http-method> 
		<http-method>DELETE</http-method>
		<http-method>HEAD</http-method>
		<http-method>OPTIONS</http-method>
		<http-method>TRACE</http-method>
	</web-resource-collection>
	<auth-constraint>
	</auth-constraint>
</security-constraint>
<login-config>
	<auth-method>BASIC</auth-method>
</login-config>