Description
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
Remediation
References
https://pivotal.io/security/cve-2019-11284
Related Vulnerabilities
CVE-2020-15252 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore
CVE-2020-11023 Vulnerability in maven package org.fujion.webjars:jquery
CVE-2018-1263 Vulnerability in maven package org.springframework.integration:spring-integration-zip
CVE-2019-17554 Vulnerability in maven package org.apache.olingo:odata-server-api
CVE-2022-23307 Vulnerability in maven package org.apache.logging.log4j:log4j