We're updating the issue view to help you get more done. 

Path traversal

Description

Access to files from /bonita webapp container is too liberal. You can get files like web.xml with HTTP request with simple path traversal. Files from WEB-INF and META-INF should not be accessible.

Environment

Tomcat and Wildfly bundles

Workaround

None

External Link

None

Status

Assignee

Pierrick Voulet

Reporter

Maciej Michalak

Reference

BS-19241

Components

Affects versions

7.8.0