Description
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
Remediation
References
https://pivotal.io/security/cve-2019-11284
Related Vulnerabilities
CVE-2020-11022 Vulnerability in maven package org.fujion.webjars:jquery
CVE-2023-32688 Vulnerability in npm package @parse/push-adapter
CVE-2021-21612 Vulnerability in maven package de.tracetronic.jenkins.plugins:ecutest
CVE-2020-6460 Vulnerability in npm package electron
CVE-2020-13926 Vulnerability in maven package org.apache.kylin:kylin-server