Description
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
Remediation
References
https://pivotal.io/security/cve-2019-11284
Related Vulnerabilities
CVE-2019-8331 Vulnerability in npm package bootstrap
CVE-2020-16013 Vulnerability in npm package electron
CVE-2016-4438 Vulnerability in maven package org.apache.struts:struts2-rest-plugin
CVE-2016-8750 Vulnerability in maven package org.apache.karaf.jaas:org.apache.karaf.jaas.modules
CVE-2016-4055 Vulnerability in maven package org.webjars.bowergithub.moment:moment