Description
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.
Remediation
References
Related Vulnerabilities
Drupal Core 8.x Multiple Vulnerabilities (8.0.0 - 8.2.2)
WordPress Plugin Strong Testimonials Cross-Site Scripting (2.40.0)
WordPress Plugin WP-SpamFree Anti-Spam 'id' Parameter SQL Injection (3.2.1)
Oracle Application Server Other Vulnerability (CVE-2006-1884)
Owncloud Cross-site Scripting (XSS) Vulnerability (CVE-2020-16255)