The vulnerability description explicitly identifies system/workplace/editors/editor.jsp as the entry point that processes the 'resource' parameter. The JSP's handling of this parameter appears to directly read and output file contents without: 1) verifying if the user should have access to the specified resource, 2) ensuring requested files are not server-side executable components (JSPs), and 3) validating path traversal attempts. This matches the CWE-200 pattern of exposing sensitive information through insufficient authorization checks. The patch in version 6.2.2 likely added validation for the resource parameter and access controls.