Highest Description
The RESTCONF request URI with encoded forward slash (/) returns the status code of 400 and the request is not processed.
For example,
{
"servlet": "org.glassfish.jersey.servlet.ServletContainer",
"message": "Invalid request",
"url": "/rests/data/network-topology:network-topology/topology=topology-netconf/node=XPDR-A1/yang-ext:mount/org-openroadm-device:org-openroadm-device/circuit-packs=1%2F0%2F1-PLUG-NET",
"status": "400"
}
This appears to be caused by Shiro 0.12.1 adopted by AAA. The version addresses a path traversal attack (CVE-2023-34478) by rejecting URIs with an encoded forward slash.
