I'm sorry for that novice question, however as a beginner I'm wondering:
isn't there a security problem if I deploy an application (e.g. on Tomcat) and I can access this via a Web-Interface, where I can login with a default username and password? Of course you have to change that login data, however isn't it possible that someone uses the time between deployment and changing login data (even if it's only seconds) to take control over the application? Couldn't attackers scan for servers with such applications and try to login with the respective default login data? I don't know if there's a motive for such attacks, as long as the applications themselves are save and you can't attack the server itself.
When installing Tomcat however, you have to specify login data in an xml-file, which you can only access as root, right? So this one seems to be safe in this respect.
Sorry for that novice question. I've searched the web for quite some time, but didn't find a specific answer.
Thank you