https://bugzilla.redhat.com/show_bug.cgi?id=1459158
--- Comment #10 from Timothy Walsh twalsh@redhat.com --- This flaw can be triggered for static error pages only if the readonly property is set to false in the $CATALINA_HOME/conf/web.xml file. The default for readonly is true.
If it is necessary to have readonly=false, a jsp error page, for example Error404.jsp should be used.