Redirects are most commonly used to translate references to outdated web pages to new, updated ones. In the case of this vulnerability, a server-side redirect transitions from a window on a web page to a file on the user's local drive. This is an allowable action. The vulnerability results because, in the course of performing the redirect, it is possible for the proper security checks to be missed. Only files that can be opened in a browser window.
Examples are .txt, .htm or .js files.
Examples of file types that cannot be opened in a browser window include .doc, .dat, .exe and other file types. The two vulnerabilities have some similarities. Both involve using redirects to bypass security restrictions, and the effect of both is to allow files on a visiting user's computer to be read. However, the similarities end there. The underlying problem in the Javascript Redirect vulnerability is a fairly straightforward implementation error, where the underlying problem here is much more complex, and depends on the timing with which various components interact with each other.