GHSA-j52r-xc68-q8f4HighCVSS 8.6

Insufficiently Protected Credentials in Pivotal Reactor Netty

Published
October 23, 2019
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2019-11284 →

📋 Description

Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.

🎯 Affected products1

  • maven/io.projectreactor.netty:reactor-netty:< 0.8.11

🔗 References (3)