Description
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
Remediation
References
https://pivotal.io/security/cve-2019-11284
Related Vulnerabilities
CVE-2022-45382 Vulnerability in maven package org.jenkins-ci.plugins:naginator
CVE-2020-2302 Vulnerability in maven package org.jenkins-ci.plugins:active-directory
CVE-2011-2731 Vulnerability in maven package org.springframework.security:spring-security-core
CVE-2023-27903 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2022-36914 Vulnerability in maven package org.jenkins-ci.plugins:files-found-trigger