title: How to reproduce JSF web.xml vulnerability
body: <p>There is a known web.xml vulnerability exist in javax.faces 2.1 jar.
  Please consider below URL to reproduce this issue and that was given by client side to reproduce this issue.</p>
  
  <pre><code>https://example.com/javax.faces.resource.../WEB-INF/web.xml.jsf (dummy URL)
  </code></pre>
  
  <p>but we are unable to reproduce this issue at our end.
  We tried using below URLs to reproduce this issue at our end.</p>
  
  <pre><code>https://&lt;external IP&gt;:8181/javax.faces.resource.../WEB-INF/web.xml.jsf
  https://&lt;Localhost&gt;:8181/javax.faces.resource.../WEB-INF/web.xml.jsf
  https://&lt;Localhost&gt;:8181/ABC/javax.faces.resource.../WEB-INF/web.xml.jsf
  </code></pre>
  
  <p>Please note that deployed application structure are same at both ends.</p>
  
  <p>So please any early help  to reproduce this issue would be highly appreciated as this issue high priority issue.</p>
  
  <p>Thanks in advance </p>