JBoss AS 7 prior to 7.1.1 and mod_cluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed.
[
{
"product": "JBoss AS 7",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "prior to 7.1.1"
}
]
}
]