Description
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
Remediation
References
https://pivotal.io/security/cve-2019-11284
Related Vulnerabilities
CVE-2022-39251 Vulnerability in npm package matrix-js-sdk
CVE-2019-10242 Vulnerability in maven package org.eclipse.kura:org.eclipse.kura.web2
CVE-2019-1003061 Vulnerability in maven package org.jenkins-ci.plugins:jenkins-cloudformation-plugin
CVE-2018-5382 Vulnerability in maven package org.bouncycastle:bcprov-jdk15on
CVE-2022-34917 Vulnerability in maven package org.apache.kafka:kafka-clients