Description
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
Remediation
References
https://pivotal.io/security/cve-2019-11284
Related Vulnerabilities
CVE-2019-12421 Vulnerability in maven package org.apache.nifi:nifi-framework
CVE-2018-1000190 Vulnerability in maven package com.blackducksoftware.integration:blackduck-hub
CVE-2023-45820 Vulnerability in npm package directus
CVE-2023-31206 Vulnerability in maven package org.apache.inlong:manager-test
CVE-2021-21604 Vulnerability in maven package org.jenkins-ci.main:jenkins-core