Description
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
Remediation
References
https://pivotal.io/security/cve-2019-11284
Related Vulnerabilities
CVE-2020-8203 Vulnerability in maven package org.webjars:lodash
CVE-2021-23267 Vulnerability in maven package org.craftercms:crafter-engine
CVE-2022-38179 Vulnerability in maven package io.ktor:ktor-utils
CVE-2020-13949 Vulnerability in maven package org.apache.thrift:libthrift
CVE-2022-34176 Vulnerability in maven package org.jenkins-ci.plugins:junit