diff --git a/java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp b/java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp
index 8cf0bc6fd76..18f7648a570 100644
--- a/java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp
+++ b/java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp
@@ -53,7 +53,8 @@ indeed slash-terminated, the user supplying <code>dir</code> can only access chi
 <li>
 OWASP:
 <a href="https://owasp.org/www-community/attacks/Path_Traversal">Partial Path Traversal</a>.
-<a href="https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/GHSL-2022-008_The_OWASP_Enterprise_Security_API.md"> ESAPI </a>
+CVE-2022-23457:
+<a href="https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/GHSL-2022-008_The_OWASP_Enterprise_Security_API.md"> ESAPI Vulnerability Report</a>
 </li>
 
 </references>