Description
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
Remediation
References
https://pivotal.io/security/cve-2019-11284
Related Vulnerabilities
CVE-2016-10006 Vulnerability in maven package org.owasp.antisamy:antisamy
CVE-2022-42125 Vulnerability in maven package com.liferay.portal:com.liferay.portal.impl
CVE-2023-41037 Vulnerability in maven package org.webjars.npm:openpgp
CVE-2023-27603 Vulnerability in maven package org.apache.linkis:linkis-common
CVE-2020-15087 Vulnerability in maven package io.prestosql:presto-main