CVE:CVE-2011-1911
CNNVD:CNNVD-201109-250
JasperReports Server Community Project 3.7.0和3.7.1版本中的JasperServer使用可预测的_flowExecutionKey参数。远程攻击者可借助暴力攻击方法执行跨站请求伪造攻击。
solution:Upgrade jasperforge jasperreports_server_community_project to a higher version than 3.7.0,3.7.1,and avoid the version 3.7.0,3.7.1