René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"CX Absolute_Path_Traversal @ src/main/webapp/vulnerability/idor/download.jsp [refs/heads/master]","articleBody":"**Absolute_Path_Traversal** issue exists @ **src/main/webapp/vulnerability/idor/download.jsp** in branch **refs/heads/master**\r\n\r\n*Method request.getParameter at line 11 of src\\main\\webapp\\vulnerability\\idor\\download.jsp gets dynamic data from the \u0026quot;\u0026quot;file\u0026quot;\u0026quot; element. This element’s value then flows through the code and is eventually used in a file path for local disk access in = at line 18 of src\\main\\webapp\\vulnerability\\idor\\download.jsp. This may cause a Path Traversal vulnerability.*\r\n\r\nSeverity: Medium\r\n\r\nCWE:36\r\n\r\n[Vulnerability details and guidance](https://cwe.mitre.org/data/definitions/36.html)\r\n\r\n[Checkmarx](https://cxprivatecloud.checkmarx.net/CxWebClient/ViewerMain.aspx?scanid=1007325\u0026projectid=1350\u0026pathid=79)\r\n\r\n[Training](null)\r\n[Recommended Fix](https://cxprivatecloud.checkmarx.net/CxWebClient/ScanQueryDescription.aspx?queryID=1670\u0026queryVersionCode=68121957\u0026queryTitle=Absolute_Path_Traversal)\r\n\r\nLines: 11 \r\n\r\n---\r\n[Code (Line #11):](null#L11)\r\n```\r\n            filePath = request.getParameter(\"file\");\r\n```\r\n---\r\n","author":{"url":"https://github.com/github-actions[bot]","@type":"Person","name":"github-actions[bot]"},"datePublished":"2022-03-14T18:35:24.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/198/JavaVulnerableLab/issues/198"}