description: In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir) to inject JSP code into the running instance.
problem types: CWE-20: Improper Input Validation
affected:
{
vendor: The Eclipse Foundation
product: Eclipse BIRT
versions:
version: unspecified, lessThanOrEqual: 4.8.0, status: affected, versionType: custom
}