Category: | Bug report |
Priority: | High |
Status: | New |
Project: | Severity: | Critical |
Resolution: | Open |
|
Component: | Reproducibility: | Always |
Assigned to: |
https://example.com/jasperserver/ - works OK, but
https://example.com/jasperserver/reportresource/reportresource?resource=... - returns 403 forbiden due to supposed traversal attack - "resource=net/sf/jasperreports/web/servlets/resources/require/report/jasperreports-report.js"
You can read more about this attack here: https://www.owasp.org/index.php/Path_Traversal