使用BlackDuck 扫描开源软件漏洞，其中一个关于Tomcat的漏洞挺有意思：
Description
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
就是说，如果tomcat可以允许PUT方法，有想法的人就可以手工craft一个请求，上传一个jsp，然后做一些勾当。
有哪位仁兄试过这个没有？