[Wrapper-user] Wrapper flagged by security scanner

[Weeks, J. <Joh...@me...>]

Hi,
 
Programmers at our site are running the "wrapper" tool.  Our security
scanner flagged this as a threat because it was able to use the "../../"
syntax to pull any random file (including the password file) off of the
server via HTTP.  I am not JAVA-literate.  Can anyone point me into the
right direction as far as how to configure wrapper to limit the
directory tree that it can see on this server?  I know how to do this in
Apache, but wrapper appears to be running on its own TPC/IP port without
using a web server as a front end.
 
-john-