Description
An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host.
Remediation
References
Related Vulnerabilities
WordPress Plugin Spot.IM Comments Cross-Site Scripting (4.0.3)
WordPress 4.4.x Multiple Vulnerabilities (4.4 - 4.4.10)
WordPress Plugin Simple Download Button Shortcode 'file' Parameter Information Disclosure (1.0)
Drupal Core 7.x Multiple Vulnerabilities (7.0 - 7.12)
MongoDb Insufficiently Protected Credentials Vulnerability (CVE-2021-32039)