GitHub Advisoryadvisory · Maven

GHSA-j52r-xc68-q8f4 Insufficiently Protected Credentials in Pivotal Reactor Netty

HIGH Published 2019-10-23 Modified 2021-08-18 Official page ↗
Aliases
CVE-2019-11284
Ecosystem
Maven
Packages
io.projectreactor.netty:reactor-netty
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-522
Reviewed
2019-10-22

Affected packages

• Maven io.projectreactor.netty:reactor-netty: < 0.8.11 → fixed in 0.8.11

Description

Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.

Related

Alias · CVE (1)

  • CVE-2019-11284 Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References