Description
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
Remediation
References
https://pivotal.io/security/cve-2019-11284
Related Vulnerabilities
CVE-2018-11775 Vulnerability in maven package org.apache.activemq:activemq-broker
CVE-2020-2289 Vulnerability in maven package org.biouno:uno-choice
CVE-2022-31167 Vulnerability in maven package org.xwiki.platform:xwiki-platform-security
CVE-2023-42276 Vulnerability in maven package cn.hutool:hutool-core
CVE-2023-32994 Vulnerability in maven package io.jenkins.plugins:miniorange-saml-sp